I've read http://alias.io/2010/01/store-passwords-safely-with-php-and-mysql/ on how to store passwords using PHP and MySQL, the secure way. Elbert says:

  • Use a cryptographically strong hashing function like SHA-1 or even SHA-256 (see PHP's hash() function).
  • Use a long and random salt for each password.
  • Use a slow hashing algorithm to make brute force attacks near impossible.
  • Regenerate the hash every time a users logs in.

I get the first three rules, however I don't see why the password should be regenerated all the time. Why is that?

  • 3
    I'm not sure either. But in that same section they also advocate using a hashed randomNumber + static text + username as the salt. Using a random salt is a good idea, but it's not clear why adding non-random data to a random number really helps, non-random data won't make a random number any more random, and the attacker doesn't need to guess or even calculate the salt, it's stored right there with the hashed password. Recalculating the hash each time will store a different randomly salted hashed password each time the user logs in, but it's not clear why this should be done.
    – Johnny
    Commented Apr 11, 2013 at 19:02

1 Answer 1


What the blog poster probably means is that you should hash the provided password when the user tries to log in, and you will have to do that hash for every login attempt, since the server stores only the hash.

It is possible, but not probable, that the author really meant to change the salt and recompute a new hash upon each login, which would be kinda stupid, explaining why I deem that "improbable". But hey, this is the Internet, anything can happen.

The blog post is partially right. Yes, you need a slow and salted hash. But no, a homemade loop of hashing cannot be condoned. Cryptographic algorithms must not be improvised; homemade is bad. What must be used is a well-vetted construction which has been inspected by many cryptographers over a long time. See this answer for details on the usual solutions. In PHP, this means using the crypt() function with the CRYPT_BLOWFISH parameter.

(Apart from the necessity of using standard constructions, it is also important to use a fast implementation, since the whole concept of slow hashing is a muscle contest between the attacker's machine and the defender's machine. Using PHP standard functions allows for accessing native code implementations, which will be much more efficient than anything written in PHP.)

You must log in to answer this question.