password_verify()
password_verify() — Verifies that a password matches a hash.
Built-in function of PHP 8.5. The manual lists it as available in PHP 5 >= 5.5.0, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.
What it does
Verifies that the given hash matches the given password. password_verify() is compatible with crypt(). Therefore, password hashes created by crypt() can be used with password_verify().
Signature
password_verify(string $password, string $hash): bool
Parameters
| Parameter | Type | What it takes |
|---|---|---|
| $password | string | The user's password. |
| $hash | string | A hash created by password_hash(). |
Return value
Returns true if the password and hash match, or false otherwise.
Example
A runnable snippet:
// See the password_hash() example to see where this came from. $hash = '$2y$12$4Umg0rCJwMswRw/l.SwHvuQV01coP0eWmGzd61QH2RvAOMANUBGC.'; if (password_verify('rasmuslerdorf', $hash)) { echo 'Password is valid!'; } else { echo 'Invalid password.'; }
Output:
Password is valid!
See also
password_needs_rehash(), password_hash()
All PHP 8.5 built-in functions
Reference card built from the PHP manual page password_verify() (PHP documentation, CC BY 3.0). The page is generated from the manual, so the wording of the parameter and return value text follows php.net.