There are numerous algorithms listed in the PHP documentation:


How strong is each one and what criteria to use when picking one?

Also the mcrypt_encrypt() function requires mode to be passed. From their docs:

One of the MCRYPT_MODE_modename constants, or one of the following strings: "ecb", "cbc", "cfb", "ofb", "nofb" or "stream".

Again, what criteria to use on choosing a mode?


1 Answer 1


You generally don't want to encrypt passwords as that opens the door to them being stolen. Instead you want to hash them, a one-way operation is mathematically impossible (or at least very hard) to reverse. This means that stealing password hashes will never lead to stealing passwords.

PHP has a great set of functions for this: password_hash and password_verify. Just use them with the default values and you'll get state of the art technology automatically. See this reference for background.

  • Generally yes. In this scenario however I need two way encryption.
    – Slava
    Apr 23, 2015 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.