Is that less secured ?

echo password_hash("rasmuslerdorf", PASSWORD_DEFAULT);
=> $2y$12$QjSH496pcT5CEbzjD/vtVeH03tfHKFy36d4J0Ltp3lRtee9HDxY3K

And with extra cost:

$options = [
    'cost' => 12,
echo password_hash("rasmuslerdorf", PASSWORD_BCRYPT, $options);


Is that "too predictable" ?

Extra question : if an encrypted password above is exposed, how long is would take to "crack" one ? Given that the hackers have dozen of good computers which only took few hours to crack our admin password in sha256 without knowing the salt.

Disclaimer : I first read about encryption 13 years ago but my brain CPU was never able to fully process those concepts, too much math. Now my boss assign me the task, so I guess asking simple question may help me a little.

  • Remember, passwords are not encrypted, but hashed. Jun 20, 2018 at 16:22
  • 1
    @multithr3at3d : ppl keep saying that but I don't understand. I guess I need to read even more. I will be back , lol. Update: I get it now, hash = one way, encrypt = reversible. Jun 20, 2018 at 16:25

1 Answer 1


It is not less secure because in absence of a manually provided salt, a securely generated salt is automatically created and used. So, the option of providing your own, while it could be as secure, would never be more secure, and could very easily be (and probably often was) less secure if salt generation technique was poor.

If it meant that no salt as all were used, that indeed would be less secure, but thankfully that is not the case...You're just getting a more secure default configuration.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .