note 103441 deleted from function.crypt by danbrown
| From: | danbrown@php.net | Date: | Wed, 13 Apr 2011 17:56:33 +0000 |
| Subject: | note 103441 deleted from function.crypt by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-178804@lists.php.net to get a copy of this message | ||
Note Submitter: varnav
----
Here is what I use to generate secure passwords. Based on what kaminski offered:
<?php
$salt = '$2a$10$'.substr(str_replace('+', '.',
base64_encode(pack('N4', mt_rand(), mt_rand(), mt_rand(), mt_rand()))), 0, 22) .
'$';
$hashed_password = crypt($password, $salt);
?>
This thing uses Blowfish algorithm. It takes 0.12 seconds on my server to generate this password,
making brute-force attack really ineffective. You may play with that "cost" value,
changing it from 10 to something. Incrementing this value by 1 roughly doubles calculation time.