Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

After a few days reading up about salting and hashing passwords, I found an actual bit of code that tells how to do it. This is what I found:

$blowfish_salt = bin2hex(openssl_random_pseudo_bytes(22));  
$hash = crypt($data, "$2a$12$".$blowfish_salt);  

Is this a good way to do it?

share|improve this question
up vote 13 down vote accepted
  1. It's easier to use the php 5.5 password_hash function, or if you're using an older version, the compatibility library
  2. openssl_random_pseudo_bytes sometimes suffers from performance issues. Consider mcrypt_create_iv (size, MCRYPT_DEV_URANDOM) instead.
  3. salt encoding is tricky. Hex doesn't use the space optimally, and normal Base64 uses invalid characters.

    $salt = substr(strtr(base64_encode($randomSalt), '+', '.'), 0, 22);

    should do the trick.

Combining these you get

$binarySalt = mcrypt_create_iv(16, MCRYPT_DEV_URANDOM);
$salt = substr(strtr(base64_encode($binarySalt), '+', '.'), 0, 22);

Check Seven Ways To Screw Up BCrypt on ircmaxell's blog for further reading.

share|improve this answer
Thanks @CodesInChaos! (Remembering I am totally new to this) would you mind putting the two suggestions together so that I can begin to understand how it should go? (I'd understand if you say no - but I have been going round and round for the last couple of days,for just that one code snippet and my brains are getting totally fried!) – vinaya Jul 24 '13 at 12:19
@vinaya I recommend using the password_hash library I linked, instead of writing it yourself. – CodesInChaos Jul 24 '13 at 12:25
Some source related to the performance issues of openssl_random_pseudo_bytes()? – gipi Jul 31 '13 at 12:33
@gipi I don't remember the details, but I guess it was this issue:… – CodesInChaos Jul 31 '13 at 12:43

There isn't anything wrong with your code. However, I always prefer to use ready made libraries for password hashing whenever possible. For PHP, there is an excellent implementation available over at PHPass.


$pwdHasher = new PasswordHash(8, FALSE);

$hash = $pwdHasher->HashPassword( $password );

Verification is done for you as well.

$checked = $pwdHasher->CheckPassword($password, $hash);
if ($checked) {
    echo 'password correct';
} else {
    echo 'wrong credentials';
share|improve this answer

You are doing it correctly. The salt you are generating is considered random and long enough (note a salt needs to be unique per password). You are also using bcrypt which is considered a secure password hashing algorithm.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.