🔴 Advanced · Lesson 33

Password Hashing

Never Store Plain Passwords

Storing passwords as plain text is dangerous. PHP's password_hash() creates a secure, one-way hash that cannot be reversed.

$password = "mypass123";
$hash = password_hash($password, PASSWORD_DEFAULT);
// store $hash in the database (not the plain password)

// $hash comes from the database
if (password_verify($_POST["password"], $hash)) {
    echo "Login successful";
} else {
    echo "Wrong password";
}

Hashes are one-way — even if your database leaks, attackers cannot easily get the original passwords. Never use md5 or sha1 for passwords.

Passwords को plain text में रखना खतरनाक है। PHP का password_hash() एक secure, one-way hash बनाता है जो reverse नहीं हो सकता।

$password = "mypass123";
$hash = password_hash($password, PASSWORD_DEFAULT);
// $hash को database में store करें (plain password नहीं)

// $hash database से आता है
if (password_verify($_POST["password"], $hash)) {
    echo "Login successful";
} else {
    echo "Wrong password";
}

Hashes one-way होते हैं — database leak हो जाए तब भी attackers आसानी से original passwords नहीं पा सकते। Passwords के लिए md5 या sha1 कभी न use करें।