When storing passwords, should I use PHP's built in
crypt or phpass?
crypt, should I use
For storing passwords, use PHPass
example of code using phpass:
internally, PHPass uses PHP's
Currently, using CRYPT_BLOWFISH is the best practice. CRYPT_BLOWFISH in PHP is an implementation of the Bcrypt hash. Bcrypt is based on the Blowfish block cipher, making use of it's expensive key setup to slow the algorithm down.
If you use PHPass as in the above example and PHP >= 5.3, you will be using BCrypt.
The answer is dependent on what do you want to achieve. Different methods are for different situations. There is another good library called PHP Secure Communications Library which you can probably use (read Who should use phpseclib?).
phpass is limited by the fact that it's trying to be PHP4 compliant. Quoting from the source code:
MD5 is totally insecure. Is your code base going to support PHP4? If not I'd suggest just using PHP's built in hash() function and pass to it 'sha512' or something.