Password Hashing

Passwords must use adaptive password hashing, never fast hashes or encryption intended for later decryption.

Practical example

<?php
$hash = password_hash($password, PASSWORD_DEFAULT);
if (!password_verify($candidate, $hash)) { throw new AuthenticationException(); }
if (password_needs_rehash($hash, PASSWORD_DEFAULT)) { $hash = password_hash($candidate, PASSWORD_DEFAULT); }

Store the full encoded hash, let PHP manage salts, and rehash after successful login when policy changes. Add rate limits, MFA where appropriate, secure reset tokens, breached-password checks, and generic authentication errors. Keep any pepper outside the database.