PHP password_hash and password_verify Tutorial: Secure Registration and Login with PDO and MySQL

Submitted by jaypabs on Monday, November 9, 2026 - 09:14.

Almost every PHP project needs a login page: a capstone system, an inventory app, a school portal, an admin panel. And almost every beginner tutorial from ten years ago still saves passwords with md5(). That is the one part of a login system you really cannot get wrong, because if your database ever leaks, weak password hashes turn into real passwords within minutes.

The good news is that PHP already has everything you need built in. In this PHP password_hash and password_verify tutorial you will learn how the two functions work, why md5() and sha1() are the wrong tool, how to pick a cost and upgrade old hashes with password_needs_rehash(), and finally how to build a small but secure registration and login system with PDO, MySQL and sessions. Every script was run on PHP 8.3 with MariaDB 11.8, and the output shown is copied from the terminal.

Requirements

PHP 7.4 or newer (PHP 8.x recommended) with the PDO MySQL extension. XAMPP, Laragon and WAMP all include it.
MySQL or MariaDB.
Basic PHP: forms, $_POST, if statements and sessions.

The complete code is in the zip file at the bottom of this page.

Hashing Is Not Encryption

Encryption can be reversed if you have the key. A password hash is one-way: you can turn a password into a hash, but you cannot turn the hash back into the password. To check a login, you hash what the user typed and compare. That way your database never stores the real password, so even you, the developer, cannot read it.

A good password hash also has two more properties: it uses a random salt so two users with the same password get different hashes, and it is deliberately slow so attackers cannot try billions of guesses per second. PHP's password_hash() does both for you.

Step 1: password_hash() and password_verify() Basics

Save this as 01_hash_basics.php and run it with php 01_hash_basics.php:

<?php
// 01_hash_basics.php - password_hash() and password_verify() basics
$password = 'MySecret#2026';
 
$hash1 = password_hash($password, PASSWORD_DEFAULT);
$hash2 = password_hash($password, PASSWORD_DEFAULT);
 
echo "Hash 1: $hash1\n";
echo "Hash 2: $hash2\n";
echo "Length: " . strlen($hash1) . " characters\n";
echo "Same hash both times? " . ($hash1 === $hash2 ? 'yes' : 'no') . "\n\n";
 
// password_verify() reads the algorithm, cost and salt from the hash itself
var_dump(password_verify('MySecret#2026', $hash1)); // correct password
var_dump(password_verify('MySecret#2026', $hash2)); // also correct
var_dump(password_verify('mysecret#2026', $hash1)); // wrong case = wrong password
 
echo "\n";
print_r(password_get_info($hash1));

Output (your hashes will be different, which is the point):

Hash 1: $2y$10$PZGKoE3iv5WDFY.1kDtcL..jswXFSL5d19mdfJ8GTrqM1xup6oTF.
Hash 2: $2y$10$vK6GsYmsKSDQwwU3sjRAcObmde9HfM75CpbGPoVGwk2UiuB.qiOHK
Length: 60 characters
Same hash both times? no

bool(true)
bool(true)
bool(false)

Array
(
    [algo] => 2y
    [algoName] => bcrypt
    [options] => Array
        (
            [cost] => 10
        )

)

What the output tells us:

The same password produced two different hashes. That is the random salt at work, and it is stored inside the hash itself.
The hash starts with $2y$10$. 2y means bcrypt and 10 is the cost. The next 22 characters are the salt and the rest is the actual hash.
password_verify() does not need the salt separately. It reads the algorithm, cost and salt from the stored hash, so you only save one column.
Passwords are case-sensitive. mysecret#2026 does not match MySecret#2026.

Important: never compare hashes yourself with ==, and never call password_hash() on the login attempt and compare it with the stored value. Because of the random salt it will never match. Always use password_verify().

Step 2: Why md5() and sha1() Are Not Safe for Passwords

Save this as 02_why_not_md5.php:

<?php
// 02_why_not_md5.php - why md5()/sha1() are the wrong tool for passwords
$password = 'password123';
 
echo "md5 : " . md5($password) . "\n";
echo "md5 : " . md5($password) . "  (same input, same output, every time)\n";
echo "sha1: " . sha1($password) . "\n\n";
 
// Count how many hashes each method can make in about 0.2 seconds
function countIn(callable $fn, float $seconds = 0.2): int {
    $n = 0; $end = microtime(true) + $seconds;
    while (microtime(true) < $end) { $fn(); $n++; }
    return $n;
}
$md5 = countIn(fn() => md5('password123'));
$bcrypt = countIn(fn() => password_hash('password123', PASSWORD_DEFAULT));
echo "md5 hashes in 0.2s:    " . ($md5 > 100000 ? 'more than 100,000' : $md5) . "\n";
echo "bcrypt hashes in 0.2s: " . ($bcrypt < 100 ? 'fewer than 100' : $bcrypt) . "\n";

Output:

md5 : 482c811da5d5b4bc6d497ffa98491e38
md5 : 482c811da5d5b4bc6d497ffa98491e38  (same input, same output, every time)
sha1: cbfdac6008f9cab4083784cbd1874f76618d2a97

md5 hashes in 0.2s:    more than 100,000
bcrypt hashes in 0.2s: fewer than 100

Two problems are visible here. First, md5('password123') gives the same result every time and on every website, so attackers simply look the hash up in huge precomputed tables. Second, md5 is extremely fast. On this ordinary machine PHP produced well over a hundred thousand md5 hashes in a fifth of a second, while bcrypt produced fewer than a hundred. For a login form, that delay is unnoticeable. For an attacker guessing millions of passwords, it is a wall.

Step 3: Choosing a Cost and Upgrading Old Hashes

The cost controls how slow bcrypt is. Each step up doubles the work. Save this as 03_cost_and_rehash.php:

<?php
// 03_cost_and_rehash.php - choosing a cost and upgrading old hashes
foreach ([10, 11, 12] as $cost) {
    $start = microtime(true);
    password_hash('test-password', PASSWORD_BCRYPT, ['cost' => $cost]);
    $ms = (microtime(true) - $start) * 1000;
    printf("cost %d: %d ms\n", $cost, $ms); // depends on your CPU
}
 
$oldHash = password_hash('test-password', PASSWORD_BCRYPT, ['cost' => 10]);
$options = ['cost' => 12];
 
echo "\nOld hash: $oldHash\n";
if (password_verify('test-password', $oldHash)
    && password_needs_rehash($oldHash, PASSWORD_DEFAULT, $options)) {
    $newHash = password_hash('test-password', PASSWORD_DEFAULT, $options);
    echo "Rehashed: $newHash\n";
    echo "Needs rehash now? " . (password_needs_rehash($newHash, PASSWORD_DEFAULT, $options) ? 'yes' : 'no') . "\n";
}
 
// bcrypt only uses the first 72 bytes of the password
$long = str_repeat('a', 72);
$h = password_hash($long, PASSWORD_BCRYPT);
echo "\n72 a's + 'XYZ' verifies against hash of 72 a's? ";
var_dump(password_verify($long . 'XYZ', $h));
 
echo "Argon2id available in this PHP build? " . (defined('PASSWORD_ARGON2ID') ? 'yes' : 'no') . "\n";

Output (timings depend on your CPU):

cost 10: 47 ms
cost 11: 95 ms
cost 12: 195 ms

Old hash: $2y$10$ApiW1gsJdvu9VkoBh8wA7.ezgDLhpU5rdcR/EGktQ0LpqqkibKQCO
Rehashed: $2y$12$aO/ZBf0HcAIxrmJrvES0D.ZYqXpgBX61w6hMYUR6jVbD4CiaVK6Fu
Needs rehash now? no

72 a's + 'XYZ' verifies against hash of 72 a's? bool(true)
Argon2id available in this PHP build? no

Notes on this example:

The timing doubles with each cost step. A login that takes a few hundred milliseconds or less is fine for users, so many developers aim for roughly 100 to 300 ms on their production server. On PHP 7.4 to 8.3 the default bcrypt cost is 10; PHP 8.4 raised the default to 12.
password_needs_rehash() returns true when a stored hash uses an older algorithm or a different cost than you want now. The only moment you know the plain password is right after a successful login, so that is where you rehash and save the new value. We will do exactly that in the login page below.
bcrypt only uses the first 72 bytes of a password. Anything after that is ignored, as the last test shows. The simple fix in a normal app is to limit passwords to 72 characters on registration.
If your PHP build has Argon2 support, you can use PASSWORD_ARGON2ID. The PHP used for this tutorial does not, and that is fine: bcrypt with PASSWORD_DEFAULT is a solid, widely used choice.

Step 4: Create the Users Table

Now let's build a real registration and login system. Create the database with this schema.sql (import it in phpMyAdmin or run it in the MySQL client):

CREATE DATABASE IF NOT EXISTS secure_login CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
USE secure_login;
 
CREATE TABLE IF NOT EXISTS users (
    id INT AUTO_INCREMENT PRIMARY KEY,
    username VARCHAR(50) NOT NULL UNIQUE,
    password_hash VARCHAR(255) NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

The password_hash column is VARCHAR(255). A bcrypt hash is 60 characters today, but the PHP manual recommends 255 so the column still fits if PASSWORD_DEFAULT changes to a longer algorithm in the future.

Step 5: Database Connection and Session Settings

Save this as config.php. Change the database user and password to match your setup (XAMPP uses root with an empty password by default):

<?php
// config.php - database connection and session setup
$host = getenv('DB_HOST') ?: '127.0.0.1';
$port = getenv('DB_PORT') ?: '3306';
$db   = 'secure_login';
$user = getenv('DB_USER') ?: 'root';
$pass = getenv('DB_PASS') ?: '';
 
$pdo = new PDO("mysql:host=$host;port=$port;dbname=$db;charset=utf8mb4", $user, $pass, [
    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
]);
 
session_start([
    'cookie_httponly' => true,
    'cookie_samesite' => 'Lax',
    'use_strict_mode' => true,
]);
 
const HASH_OPTIONS = ['cost' => 12];
 
function e(string $s): string {
    return htmlspecialchars($s, ENT_QUOTES, 'UTF-8');
}

The session options make the session cookie unreadable by JavaScript (cookie_httponly), not sent on cross-site form posts (cookie_samesite), and reject made-up session IDs (use_strict_mode). When your site runs on HTTPS, also add 'cookie_secure' => true. The e() helper escapes output to prevent XSS.

Step 6: The Registration Page

Save this as register.php:

<?php
// register.php - create an account with a hashed password
require 'config.php';
 
$errors = [];
$username = '';
 
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
    $confirm  = $_POST['confirm'] ?? '';
 
    if (!preg_match('/^[A-Za-z0-9_]{3,50}$/', $username)) {
        $errors[] = 'Username must be 3-50 letters, numbers or underscores.';
    }
    if (strlen($password) < 8) {
        $errors[] = 'Password must be at least 8 characters.';
    }
    if (strlen($password) > 72) {
        $errors[] = 'Password must be 72 characters or fewer.';
    }
    if ($password !== $confirm) {
        $errors[] = 'Passwords do not match.';
    }
 
    if (!$errors) {
        $stmt = $pdo->prepare('SELECT id FROM users WHERE username = ?');
        $stmt->execute([$username]);
        if ($stmt->fetch()) {
            $errors[] = 'That username is already taken.';
        }
    }
 
    if (!$errors) {
        $hash = password_hash($password, PASSWORD_DEFAULT, HASH_OPTIONS);
        $stmt = $pdo->prepare('INSERT INTO users (username, password_hash) VALUES (?, ?)');
        $stmt->execute([$username, $hash]);
        header('Location: login.php?registered=1');
        exit;
    }
}
?>
<!doctype html>
<html>
<head><meta charset="utf-8"><title>Register</title></head>
<body>
<h1>Create an Account</h1>
<?php foreach ($errors as $err): ?>
  <p style="color:#b00"><?= e($err) ?></p>
<?php endforeach; ?>
<form method="post">
  <p><label>Username<br><input name="username" value="<?= e($username) ?>" required></label></p>
  <p><label>Password<br><input type="password" name="password" required></label></p>
  <p><label>Confirm password<br><input type="password" name="confirm" required></label></p>
  <button type="submit">Register</button>
</form>
<p>Already have an account? <a href="login.php">Log in</a></p>
</body>
</html>

The registration flow validates the username and password, checks that the username is free with a prepared statement, then stores only the result of password_hash(). The plain password is never written anywhere. After a successful insert we redirect, so refreshing the page does not submit the form twice.

Step 7: The Login Page

Save this as login.php:

<?php
// login.php - verify the password and start a session
require 'config.php';
 
$error = '';
 
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $password = $_POST['password'] ?? '';
 
    $stmt = $pdo->prepare('SELECT id, username, password_hash FROM users WHERE username = ?');
    $stmt->execute([$username]);
    $user = $stmt->fetch();
 
    if ($user && password_verify($password, $user['password_hash'])) {
        // Upgrade the hash if the algorithm or cost has changed
        if (password_needs_rehash($user['password_hash'], PASSWORD_DEFAULT, HASH_OPTIONS)) {
            $newHash = password_hash($password, PASSWORD_DEFAULT, HASH_OPTIONS);
            $pdo->prepare('UPDATE users SET password_hash = ? WHERE id = ?')
                ->execute([$newHash, $user['id']]);
        }
 
        session_regenerate_id(true); // prevent session fixation
        $_SESSION['user_id']  = $user['id'];
        $_SESSION['username'] = $user['username'];
        header('Location: dashboard.php');
        exit;
    }
 
    // Same message for unknown user and wrong password
    $error = 'Invalid username or password.';
}
?>
<!doctype html>
<html>
<head><meta charset="utf-8"><title>Login</title></head>
<body>
<h1>Log In</h1>
<?php if (isset($_GET['registered'])): ?>
  <p style="color:#070">Account created. You can log in now.</p>
<?php endif; ?>
<?php if ($error): ?>
  <p style="color:#b00"><?= e($error) ?></p>
<?php endif; ?>
<form method="post">
  <p><label>Username<br><input name="username" required></label></p>
  <p><label>Password<br><input type="password" name="password" required></label></p>
  <button type="submit">Log in</button>
</form>
<p>No account yet? <a href="register.php">Register</a></p>
</body>
</html>

Four details make this login page safer than most copy-paste examples:

It looks up the user by username only, then checks the password with password_verify(). Never put the password in the WHERE clause.
It shows the same error message for an unknown username and a wrong password, so attackers cannot use the form to discover which usernames exist.
It upgrades old hashes automatically with password_needs_rehash().
It calls session_regenerate_id(true) after login to block session fixation attacks.

Step 8: Protect Pages and Log Out

Any page that requires login just checks the session. Save this as dashboard.php:

<?php
// dashboard.php - members-only page
require 'config.php';
 
if (empty($_SESSION['user_id'])) {
    header('Location: login.php');
    exit;
}
?>
<!doctype html>
<html>
<head><meta charset="utf-8"><title>Dashboard</title></head>
<body>
<h1>Welcome, <?= e($_SESSION['username']) ?>!</h1>
<p>You are logged in. Only signed-in users can see this page.</p>
<p><a href="logout.php">Log out</a></p>
</body>
</html>

And logout.php clears the session data, deletes the cookie and destroys the session:

<?php
// logout.php - end the session completely
require 'config.php';
 
$_SESSION = [];
if (ini_get('session.use_cookies')) {
    $p = session_get_cookie_params();
    setcookie(session_name(), '', time() - 42000, $p['path'], $p['domain'], $p['secure'], $p['httponly']);
}
session_destroy();
header('Location: login.php');
exit;

Step 9: Test the Whole Flow

Start the PHP built-in server inside the secure-login folder with php -S localhost:8000 (or put the folder in htdocs) and open http://localhost:8000/register.php. I tested every path with a small curl script, included in the zip as test_login.sh. Here is the result:

1) dashboard as guest:
   302 -> http://localhost:8000/login.php
2) register with short password:
   Password must be at least 8 characters.
3) register juan_dc:
   302 -> http://localhost:8000/login.php?registered=1
4) register juan_dc again:
   That username is already taken.
5) stored row:
   1	juan_dc	$2y$12$	60
6) wrong password:
   Invalid username or password.
7) unknown user:
   Invalid username or password.
8) correct login:
   302 -> http://localhost:8000/dashboard.php
9) dashboard with session:
   <h1>Welcome, juan_dc!</h1>
10) logout then dashboard:
   302 -> http://localhost:8000/login.php
11) old cost-10 account is upgraded on login:
   before: $2y$10$
   after:  $2y$12$

Everything behaves as expected: guests are redirected, weak passwords and duplicate usernames are rejected, the database stores only a 60-character bcrypt hash with cost 12, both kinds of failed login give the same message, and logout really ends the session. Test 11 shows an old cost-10 hash being upgraded to cost 12 the moment that user logs in.

Common Mistakes to Avoid

Using md5(), sha1() or hash('sha256') for passwords. They are fine for checksums, not for passwords.
Making the column too short. A VARCHAR(32) left over from md5 will cut the hash, and every login will fail.
Trimming or changing the password before hashing. Hash exactly what the user typed, and do the same on login.
Building SQL with string concatenation. Always use prepared statements, as in this tutorial.
Showing "username not found" vs "wrong password". Use one generic message.

Conclusion

Secure password storage in PHP comes down to a handful of built-in functions: password_hash() when a user registers, password_verify() when they log in, and password_needs_rehash() to keep old hashes up to date. Combine them with prepared statements, a regenerated session ID and a generic error message and you have a login system that is far safer than most of the examples still floating around. Download the zip below, run the test script, and drop the pattern into your next capstone or client project.

Search