Answer by T0xicCode for password_hash function in php 5.5

Hashes generated by password_hash (and most good password hashing algorithms) are salted. That means that an extra set of random data is added to each password before and sometimes during hashing.

A common format for password hashes is ##xxxxxxOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO, where:

• ## is the hashing algorithm identifier,
• xxxxxx is the salt, and
• OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO is the hashed password.

When comparing the stored hash with a given clear-text password, the algorithm will take the ##xxxxxx part of the hash and use it to calculate a new password hash (say ##xxxxxxNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN). It them compares the two hashes, and if they are equal, it can assume that the given clear-text password was the same as the initial password.

Because this differs from static hashes, you must use password_hash to initially hash the password on registration or password change, and password_verify to check if the given password is correct.