First: I asked this question on stackoverflow and was kindly asked to post this here again. See the original question here.
According to the [early] doc pages of the new PHP 5.5 password hashing/encrypting API the used algorithm
CRYPT_BLOWFISH is "strongest algorithm currently supported by PHP" (please do a full text search to find the quote on the page).
My question is: Can this be proven with some numbers, benchmarks etc. ?
According to the PHP's
crypt() doc page
CRYPT_BLOWFISH uses 22 char salt and generates a 60 char hash, and
CRYPT_SHA512 uses a 16 char salt and generates a 118 char hash. Both algorithms have changeable cost factors, so at first view, SHA512 looks stronger (because longer).