1

This question already has an answer here:

password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The benefit is using the built-in password_verify() and password_needs_rehash() functions in PHP.

I was wondering if SHA3-512 with unsalted hashes, hash("sha3-512", $password); would be better, worse or as good as the password_hash option.

marked as duplicate by Steffen Ullrich, AndrolGenhald, PwdRsch, schroeder Apr 11 at 8:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 4
    Possible duplicate of How to securely hash passwords?. In summary: SHA3 is fast so brute force is feasible, no salt means rainbow tables can be build to crack common passwords. password_hash does not have these problems. – Steffen Ullrich Apr 10 at 18:41
3

Unsalted SHA3 is a terrible choise for password hashing. Go with bcrypt instead.

First, you want password hash functions to be slow so that brute forcing is slow. Bcrypt is designed to be slow. SHA3 is designed to be fast.

Second, you always want to use a salt. The salt forces the attacker to attack one password at a time instead of all at once. You want that.

3

For passwords, bcrypt is a much better option that SHA-3. SHA-3 and bcrypt serve different purposes. BCrypt is a Key-Derivation Function, while SHA-3 is a regular hash. KDFs are deliberately more computationally intensive than standard has functions. The slower a hashing function is, the longer it takes to crack. This helps protect against offline attacks in the event the hashes are stolen.

The below article can give you a good overview as to the threat you are trying to defend against.
https://arstechnica.com/information-technology/2012/08/passwords-under-assault/

Not the answer you're looking for? Browse other questions tagged or ask your own question.