PHP password_verify() Function

The PHP password_verify() function is used to verify that the given hash matches the given password.

The password_hash() function returns the algorithm, cost and salt as part of the returned hash. Therefore, all information that is needed to verify the hash is included in it. This allows password_verify() to verify the hash without needing separate storage for the salt or algorithm information.

The password_verify() function is safe against timing attacks.

Syntax

password_verify(password, hash)

Parameters

Return Value

Returns true if the password and hash match, or false otherwise.

Example: password_verify() example

The example below shows the usage of password_verify() function.

<?php
$hash = "$2y$10$.SCsHZ4KA04AFwoRj6XOS.6iKtQzsO.ydxo6gOVbauASPEoV6cm4a";

if(password_verify('myPassword', $hash)) {
  echo 'Password is valid!';
} else {
  echo 'Invalid password.';
}
?>

The output of the above code will be:

Password is valid!