note 115629 added to function.password-hash

For passwords, you generally want the hash calculation time to be between 250 and 500 ms (maybe more for administrator accounts). Since calculation time is dependent on the capabilities of the server, using the same cost parameter on two different servers may result in vastly different execution times. Here's a quick little function that will help you determine what cost parameter you should be using for your server to make sure you are within this range (note, I am providing a salt to eliminate any latency caused by creating a pseudorandom salt, but this should not be done when hashing passwords): <?php /** * @Param int $min_ms Minimum amount of time in milliseconds that it should take * to calculate the hashes */ function getOptimalBcryptCostParameter($min_ms = 250) { for ($i = 4; $i < 31; $i++) { $options = [ 'cost' => $i, 'salt' => 'usesomesillystringforsalt' ]; $time_start = microtime(true); password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options); $time_end = microtime(true); if (($time_end - $time_start) * 1000 > $min_ms) { return $i; } } } echo getOptimalBcryptCostParameter(); // prints 12 in my case ?> ---- Server IP: 72.52.91.14 Probable Submitter: 186.177.179.211 ---- Manual Page -- http://php.net/manual/en/function.password-hash.php Edit -- https://master.php.net/note/edit/115629 Del: integrated -- https://master.php.net/note/delete/115629/integrated Del: useless -- https://master.php.net/note/delete/115629/useless Del: bad code -- https://master.php.net/note/delete/115629/bad+code Del: spam -- https://master.php.net/note/delete/115629/spam Del: non-english -- https://master.php.net/note/delete/115629/non-english Del: in docs -- https://master.php.net/note/delete/115629/in+docs Del: other reasons-- https://master.php.net/note/delete/115629 Reject -- https://master.php.net/note/reject/115629 Search -- https://master.php.net/manage/user-notes.php