Skip to main content
Security & Authentication Tools

PHP Password Hash Generator

Generate a real hash compatible with PHP's password_hash() - bcrypt (PASSWORD_BCRYPT) or Argon2id (PASSWORD_ARGON2ID) - verifiable with password_verify().

Choose bcrypt or Argon2id (PHP's two modern password_hash() algorithms) - this tool generates a real hash in the exact format PHP produces.

Computed entirely in your browser using real bcrypt/Argon2 implementations - your password is never transmitted anywhere.

This generates hash text only - no PHP code is executed. The output is directly usable with PHP's own password_verify() function.

How PHP Hashes Passwords

PHP's password_hash() function supports PASSWORD_BCRYPT (default, producing a $2y$-prefixed hash) and PASSWORD_ARGON2I/PASSWORD_ARGON2ID - all producing self-contained, standard hash strings that password_verify() can check directly.

Why Use This Tool?

Useful for generating a real password hash for a database seed, test fixture, or manual verification - without writing and running a one-off PHP script.

How to Use It

  1. Choose bcrypt or Argon2id.
  2. Enter a password and adjust cost/memory parameters if needed.
  3. Copy the generated hash - directly usable with password_verify($password, $hash).

Understanding $2y$ vs $2b$

PHP's bcrypt implementation uses the $2y$ identifier (a PHP-specific fix for a historical sign-extension bug in some other bcrypt implementations) - modern bcrypt libraries handle $2y$ hashes correctly, and this tool generates hashes with that same PHP-standard prefix.

Frequently Asked Questions

Call password_verify($password, $hash). It reads the algorithm, cost and salt from the hash string itself.

$2y$ is PHP's bcrypt identifier. Hashes starting with $2a$ or $2b$ from other languages are also accepted by password_verify().

After you raise the cost or change algorithm, it tells you which stored hashes use old settings so you can rehash them when the user next logs in.
Share this tool: