Modern hashing methods (which
password_hash uses) are intentionally slow to make it impossible to do exactly what you are trying to do. Most are even resistant against parallelization with a GPU.
So if your goal is to speed up running through a 1 GB password list against a modern password algorithm, there is only one answer: there is no way to do so without running the whole thing on a gigantic computing cluster. Even then, a long enough password can be literally uncrackable.
You cannot accomplish what you are trying to do.
"You cannot do this" is the sort of statement that could use some hard numbers!
To crack a password we first need to know how fast we can test hashes. I'm borrowing liberally from a real-life example when someone tried to crack the passwords in the Ashley Madison data dump using a cracking rig with 4 GPUs. This is far better hardware than your typical home user will have access to. In that case bcrypt was configured to use a cost factor 12 (aka 4069 rounds of hashing), and the 4 GPU rig could only manage 156 hashes per second. For a lower cost factor the hash rate rises quickly. PHP uses 10 by default, which naively would result in a 4 times higher hash rate. We'll round up for fun and pretend we manage to hit 750 hashes/second.
Next we need to know how many passwords we're trying to crack. Let's use a few examples: all possible 4 character passwords (numbers, letters, 10 special characters), all possible 6 character passwords, all possible 8 character passwords, or a 1Gbyte file filled with passwords. This is how many passwords are in each list:
- All 4 digit passwords:
72^4 = ~27,000,000 combinations
- All 6 digit passwords:
72^6 = ~74,000,000,000 combinations
- All 8 digit passwords:
72^8 = ~700 trillion combinations
- A 1Gbyte file: ~100,000,000 passwords (assuming 10 bytes per password on average)
We know how many passwords we want to hash and our hashing rate (750/s), so now simple math tells us how long it will take to run through these lists with a top-of-the-line hashing algorithm:
- All 4 digit passwords: ~10 hours
- All 6 digit passwords: ~6 years
- All 8 digit passwords: ~30,000 years
- A 1 GB file: ~1.5 days
For more realistic numbers I roughly estimated the hash rate using one of the CPUs of my own machine, managing about 10 hashes per second. Using that hash rate:
- All 4 digit passwords: ~30 days
- All 6 digit passwords: ~450 years
- All 8 digit passwords: ~2 million years
- A 1 GB file: ~115 days
Buy yourself a half dozen high quality GPUs and, presuming you use the default cost factor, you would be able to crack all possible 4 digit passwords in about a day. Try doing just the 6 digit passwords and it will still take you years. Your 1 GB file filled with passwords is harder to guess the time for, but realistically that will still take a few days to run through even with a bunch of GPUs helping you out.