password_verify() takes two arguments: a string of which you want to check if it's the correct password, and the value you calculated earlier with
password_hash(), which you presumably stored somewhere in a database or so.
A typical application could be:
$hash = password_hash('my-secret', PASSWORD_DEFAULT);
// normally you would save the hash somewhere, but we'll just continue in this example
$check_a = 'other-secret';
$check_b = 'my-secret';
if (password_verify($check_a, $hash))
echo 'Check A was the original password: ' . $check_a;
if (password_verify($check_b, $hash))
echo 'Check B was the original password: ' . $check_b;
The output will be:
Check B was the original password: my-secret
If you want to get the original password from a hash calculated by
password_hash(), you'll need to try all possibilities - that's what this example shows. Because of the architecture of
password_hash(), finding a password like this will take a long time, so it's not worth it.
Note also, from the
PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).
The algorithm is designed to change over time, so that it stays secure, and finding a password by brute force won't become possible with faster computers (presuming, the PHP installation on your server is up to date)
In any case, a hash is one-way: you can't turn it around. You can only verify a given password by computing the hash of that one, and checking if it's the same.