从PHP 5.5开始，PHP就有了简单安全的散列和验证密码的函数password_hash()和password_verify()

$password = 'anna';
$hash = password_hash($password, PASSWORD_DEFAULT);
$expensiveHash = password_hash($password, PASSWORD_DEFAULT, array('cost' => 20));

password_verify('anna', $hash); //Returns true
password_verify('anna', $expensiveHash); //Also returns true
password_verify('elsa', $hash); //Returns false

当使用password_hash()时，它生成一个随机的盐并将其包含在输出的哈希中(以及使用的代价和算法)。password_verify()然后读取该哈希并确定使用的盐和加密方法，并根据提供的明文密码验证它。

提供PASSWORD_DEFAULT指示PHP使用已安装的PHP版本的默认哈希算法。具体哪种算法在未来的版本中会随着时间的推移而改变，因此它将始终是可用的最强算法之一。

不断增加的成本(默认为10)使得哈希更难使用暴力，但也意味着生成哈希并根据它们验证密码将为服务器的CPU带来更多的工作。

请注意，即使默认的哈希算法可能会改变，旧的哈希将继续进行验证，因为所使用的算法存储在哈希中，password_verify()会捕获它。

谷歌表示SHA256对PHP可用。

你一定要加盐。我建议使用随机字节(不要限制自己使用字符和数字)。通常情况下，你选择的时间越长，就越安全、越慢。64字节应该就可以了。

虽然问题已经回答了，但我只是想重申，用于哈希的盐应该是随机的，而不是像第一个答案中建议的电子邮件地址那样。

更多的解释可以在(archive.org的副本)http://www.pivotalsecurity.com/blog/password-hashing-salt-should-it-be-random/上找到

Recently I had a discussion whether password hashes salted with random bits are more secure than the one salted with guessable or known salts. Let’s see: If the system storing password is compromised as well as the system which stores the random salt, the attacker will have access to hash as well as salt, so whether the salt is random or not, doesn’t matter. The attacker will can generate pre-computed rainbow tables to crack the hash. Here comes the interesting part- it is not so trivial to generate pre-computed tables. Let us take example of WPA security model. Your WPA password is actually never sent to Wireless Access Point. Instead, it is hashed with your SSID (the network name- like Linksys, Dlink etc). A very good explanation of how this works is here. In order to retrieve password from hash, you will need to know the password as well as salt (network name). Church of Wifi has already pre-computed hash tables which has top 1000 SSIDs and about 1 million passwords. The size is of all tables is about 40 GB. As you can read on their site, someone used 15 FGPA arrays for 3 days to generate these tables. Assuming victim is using the SSID as “a387csf3″ and password as “123456″, will it be cracked by those tables? No! .. it cannot. Even if the password is weak, the tables don’t have hashes for SSID a387csf3. This is the beauty of having random salt. It will deter crackers who thrive upon pre-computed tables. Can it stop a determined hacker? Probably not. But using random salts does provide additional layer of defense. While we are on this topic, let us discuss additional advantage of storing random salts on a separate system. Scenario #1 : Password hashes are stored on system X and salt values used for hashing are stored on system Y. These salt values are guessable or known (e.g. username) Scenario#2 : Password hashes are stored on system X and salt values used for hashing are stored on system Y. These salt values are random. In case system X has been compromised, as you can guess, there is a huge advantage of using random salt on a separate system (Scenario #2) . The attacker will need to guess addition values to be able to crack hashes. If a 32 bit salt is used, 2^32= 4,294,967,296 (about 4.2 billion) iterations will can be required for each password guessed.

我通常使用SHA1和salt和用户ID(或其他特定于用户的信息)，有时我还使用常数salt(因此我有2部分salt)。

SHA1 is now also considered somewhat compromised, but to a far lesser degree than MD5. By using a salt (any salt), you're preventing the use of a generic rainbow table to attack your hashes (some people have even had success using Google as a sort of rainbow table by searching for the hash). An attacker could conceivably generate a rainbow table using your salt, so that's why you should include a user-specific salt. That way, they will have to generate a rainbow table for each and every record in your system, not just one for your entire system! With that type of salting, even MD5 is decently secure.

我使用的是Phpass，这是一个简单的单文件PHP类，可以在几乎每个PHP项目中非常容易地实现。参见The H。

默认情况下，它使用在Phpass中实现的最强可用加密，即bcrypt，并回落到其他加密，直到MD5，以提供向后兼容的框架，如Wordpress。

返回的散列可以按原样存储在数据库中。生成哈希的示例使用如下:

$t_hasher = new PasswordHash(8, FALSE);
$hash = $t_hasher->HashPassword($password);

要验证密码，可以使用:

$t_hasher = new PasswordHash(8, FALSE);
$check = $t_hasher->CheckPassword($password, $hash);

一个更简短、更安全的答案是:完全不要编写自己的密码机制，使用经过验证和测试的机制。

PHP 5.5或更高版本:password_hash()质量很好，是PHP核心的一部分。 PHP 4。x(过时):OpenWall的phpass库比大多数自定义代码(用于WordPress、Drupal等)要好得多。

大多数程序员只是不具备在不引入漏洞的情况下安全地编写加密相关代码的专业知识。

快速自测:什么是密码拉伸，应该使用多少次迭代?如果你不知道答案，你应该使用password_hash()，因为密码扩展现在是密码机制的一个关键特性，这是由于更快的cpu和gpu和fpga的使用，以每秒数十亿次的猜测速度破解密码(gpu)。

截至2012年，你可以在5台台式电脑上安装25个图形处理器，在6小时内破解所有8个字符的Windows密码。这是强制的，即枚举和检查每个8个字符的Windows密码，包括特殊字符，而不是字典攻击。有了现代gpu，你当然可以破解更多的密码，或者使用更少的gpu——或者以合理的价格在云中租用gpu几个小时。

还有很多针对Windows密码的彩虹表攻击，它们运行在普通cpu上，速度非常快。

这一切都是因为，即使在Windows 10中，Windows也没有对密码进行腌制或拉伸。2021年依然如此。不要犯和微软一样的错误!

参见:

很好的回答，更多关于为什么password_hash()或phpass是最好的方法。 一篇很好的博客文章，给出了主要算法的推荐“工作因子”(迭代次数)，包括bcrypt, scrypt和PBKDF2。