PHP password_hash() Generator
Run PHP’s password_hash() with the algorithm and cost of your choice.
How to use the PHP password_hash() Generator
- Type the password you want to hash.
- Pick the algorithm — PASSWORD_DEFAULT and PASSWORD_BCRYPT use the cost factor; the Argon2 options ignore it.
- Click Run password_hash() and copy the resulting hash.
About the PHP password_hash() Generator
This is PHP’s own password_hash() function, run on the server exactly as it would run in your code. Pick the algorithm through the same constants PHP uses — PASSWORD_DEFAULT, PASSWORD_BCRYPT, PASSWORD_ARGON2I or PASSWORD_ARGON2ID — set a cost, and you get back the precise string the function produces, plus the breakdown that password_get_info() reports. It is the quick way to see what a given password and setting actually generate, without spinning up a script.
Two things are true of every hash here and worth understanding. First, the output is salted automatically, so running the same password twice gives two different hashes — that is correct, not a bug, and it is why you must never compare hashes by re-hashing. You check a password with password_verify($password, $hash), which reads the salt and cost out of the stored hash and does the comparison for you. Second, the cost (bcrypt) and the memory and time parameters (Argon2) are deliberately slow: they set how expensive each guess is for an attacker, so a higher cost is safer but takes longer. This tool caps bcrypt at cost 12 and uses fixed Argon2 parameters so a public endpoint can’t be turned into a CPU drain.
PASSWORD_DEFAULT is bcrypt in every PHP release to date, but it is defined as “whatever PHP currently considers best”, so it can change in a future version — which is exactly why you store the algorithm inside the hash and let password_verify() sort it out. For most new projects Argon2id is the current best practice. Note that bcrypt silently ignores anything past the first 72 bytes of a password, so this tool refuses a longer one rather than hash a truncated version. Need to check a hash instead of make one? Use the bcrypt & Argon2 verifier, or compare algorithms with the Argon2 generator. Passwords are hashed and discarded — never logged or stored.
Frequently asked questions
Which algorithm should I choose?
For new projects, PASSWORD_ARGON2ID is the current best practice where your PHP build supports it. PASSWORD_DEFAULT is a safe, portable choice too — it is bcrypt today and PHP upgrades it over time. Plain PASSWORD_BCRYPT is fine and universally available.
Why does the same password give a different hash each time?
Because password_hash() generates a fresh random salt every call and stores it inside the output. That is exactly what you want — it stops two identical passwords from producing identical hashes. Never compare passwords by re-hashing; use password_verify() instead.
What does the cost factor do?
For bcrypt (and PASSWORD_DEFAULT) it sets how many rounds of work each hash takes — every +1 roughly doubles the time. Higher is more resistant to brute force but slower to compute. The Argon2 options ignore this cost and use fixed memory and time parameters instead.
How do I check a password against one of these hashes later?
Call password_verify($password, $hash). It reads the algorithm, salt and cost out of the stored hash and returns true or false. You do not need to know or store the algorithm separately — it is part of the hash string.
Is it safe to hash a real password here?
The password is sent to the server, hashed and immediately discarded — nothing is logged or stored, and the response carries a no-store header. Even so, for a password you actually use in production, generating the hash inside your own environment is always the most cautious choice.