Follow-up to this question: Strong PHP hashing without salt.

Without entering into the details, using bcrypt without salt/pepper is a bit complex for my case, so I'm staying on a "plain loop" implementation.

In the "version 1" below, I'm simply hashing the sha512 repeatedly, whereas in "version 2" I include the input data in each iteration:

$data = $websiteDomain . $myChildSchool . $myPetName . $etc;

// version 1
$result = $data;
for ($i = 0; $i < 1000000; ++$i) {
    $result = hash('sha512', $result, true);

// version 2
$result = '';
for ($i = 0; $i < 1000000; ++$i) {
    $result = hash('sha512', $data . $result, true);

$result = str_replace(['/', '+', '='], '', base64_encode($result));
$result = substr($result, 0, $passwordLength);

Is "version 2" more secure?

I'm thinking about stuff like parallelization for "version 1", where the first hash would be normally computed, then the 999,999 remaining hashes of each candidate would be computed using some parallelized processing.


1 Answer 1


using bcrypt without salt/pepper is a bit complex for my case

Use bcrypt with the cost parameter specified for key stretching, examples in the official doc: http://php.net/manual/en/function.password-hash.php

password_hash("unsalted password", PASSWORD_BCRYPT, ["cost" => $cost]);

Is it more complex? I don't think so.

Side note: all PHP versions where password_hash is supported, have automatic salt generation enabled by default. If not using PHP7, you can specify your own (salt parameter in the array) but I don't see the point of doing so.

  • It's for some specific use case, I don't want random salt as I need the hash to be reproducible. And as I mentioned in a comment above, defining a salt is a pain, also it just won't be possible in the future. Dec 28, 2016 at 13:24
  • Apparently you misunderstood, by "bcrypt without salt" I don't mean "let the application generate the salt", but "use no salt" (i.e. empty, or constant). Dec 28, 2016 at 13:32
  • Okay, I missed your previous topic. bcrypt is not capable of making reproducible hashes without providing the salt. I can't remember another SPL function for key stretching that would fit your needs. Dec 28, 2016 at 13:32
  • But if you give up ever migrating to PHP7, you can still use it :) Dec 28, 2016 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .