Would this be secure enough to hash passwords?

 * Creates a SHA-256 hash
 * @param  string $salt Salt for hashing algorithm
 * @param  string $string What is getting hashed
 * @return string Returns a hashed string
public function hash ($string, $salt) {
    $crypt = crypt($string, '$5$rounds=5000$' . $salt . '$');
    $hash = str_replace('$5$rounds=5000$' . $salt . '$', '', $crypt);

    return $hash;

Using SHA-256 with a salt is not that bad. But PHP has built in functions like password_hash and password_verify to hash passwords. It uses bcrypt, which is currently one of the best methods to hash passwords these days. I would recommend this approach and it is just as easy to use like the function you've written.


The '$5$rounds=5000$' is appended on crypt, so you are able to know which algorithm was used to store your users password. If you ever want to change the algorithm you may do so but you will have to make a choice.

You either keep support to your old hashing algorithm (and keep hashing the password for the old users with that algorithm), or you prompt all users with the old hash algorithm to choose a new password (you still have to verify their password with the old hash algorithm until all users change their password, notice that this can be done on a successful login).

Resuming: If you don't plan to change your hashing algorithm it's ok to remove '$5$rounds=5000$' from the result.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.