like the documentation of
password_hash states, a unique salt is being calculated for each time it is called.
It is strongly recommended that you do not generate your own salt for this function. It will create a secure salt automatically for you if you do not specify one.
(source: php manual - password_hash)
Additionally the used options of the hashing process are stored in the generated hash itself(salt,cost,algo) so the
password_verify has all information's it needs to verify if a plaintext matches a hash without being able to decrypt it.
Note that password_hash() returns the algorithm, cost and salt as part of the returned hash. Therefore, all information that's needed to verify the hash is included in it.
(source: enter link description here)
This also explains why the start of most hashes are identical.
For example depending on the cost and algo used your hashes might always start with something like
$2y$10$ and from then on differ. This behavior can however change between different frameworks, algorithms or other factors, so take this only as a example of how the cost and algo can be saved in the resulted hash.
password_hash()automatically generates a salt.