# Is this password hashing function safe?

Would this be secure enough to hash passwords?

/**
* Creates a SHA-256 hash
* @param  string $salt Salt for hashing algorithm * @param string$string What is getting hashed
* @return string Returns a hashed string
*/
public function hash ($string,$salt) {
$crypt = crypt($string, '$5$rounds=5000$' .$salt . '$');$hash = str_replace('$5$rounds=5000$' .$salt . '$', '',$crypt);

return $hash; }  ## 2 Answers Using SHA-256 with a salt is not that bad. But PHP has built in functions like password_hash and password_verify to hash passwords. It uses bcrypt, which is currently one of the best methods to hash passwords these days. I would recommend this approach and it is just as easy to use like the function you've written. • If we are talking about the best - password-hashing.net Apr 4 '16 at 17:01 The '$5$rounds=5000$' is appended on crypt, so you are able to know which algorithm was used to store your users password. If you ever want to change the algorithm you may do so but you will have to make a choice.

You either keep support to your old hashing algorithm (and keep hashing the password for the old users with that algorithm), or you prompt all users with the old hash algorithm to choose a new password (you still have to verify their password with the old hash algorithm until all users change their password, notice that this can be done on a successful login).

Resuming: If you don't plan to change your hashing algorithm it's ok to remove '$5$rounds=5000\$' from the result.