I have a manager who likes to "deactivate" accounts by replacing the existing bcrypt hash in the database with a simple dash (`-`).

[![A dash in a family of bcrypt hashes](https://i.stack.imgur.com/gE4Cr.png)](https://i.stack.imgur.com/gE4Cr.png)

This seems to work as the old password is no longer valid and there is no valid bcrypt hash that any other password could match. But I was curious, is this effective or does it create a security risk?

**Is this an effective way to make no password work or does it create a larger security risk?**

This specific implementation uses the PHP [password\_verify](http://php.net/manual/en/function.password-verify.php) function but I would like answers to focus on any general implementation. Please do not focus on my manager's bad practice. We also have a boolean field for setting the user to inactive/active which I believe is better and safer but is not what I want answers to focus on.