About this question
Why does this example from the PHP manual give different results every time it runs? echo password_hash("rasmus lerdorf", PASSWORD_DEFAULT); And then, password_verify() knows that ALL those hashes match "rasmus lerdorf"! It is like magic to me even the doc stated clearly:
Note that password_hash() returns the algorithm, cost and salt as part of the returned hash. Therefore, all information that's needed to verify the hash is included in it. This allows the verify function to verify the hash without needing separate storage for the salt or algorithm information.
This function is safe against timing attacks.
echo password_verify ( 'rasmus lerdorf' , '$2y$10$EMawXU7qNS4GzU2Do8bByeb7sSQZxecvmZ6mBrToxsOaY7RMAIGua' ); //=>true
echo password_verify ( 'rasmus lerdorf' , '$2y$10$0vMA2k7LxTBstI/J7clkkuZZ/XtuS1fklVuoM6sl4Fc/aj1avQa5u' ); //=>true
echo password_verify ( 'rasmus lerdorf' , '$2y$10$iuE2EzHMNONAWFKh/4Wyl.dcBxgFaNzAh32va0/gyE4ScqnNr/Uc.' ); //=>true
What is going on? How does password_verify() know some crazy string match 'rasmus lerdorf' but hackers don't?
