title: Is PHP password_hash() + password_verify() safe today (May 2016)?
body: <p>So the question is pretty much in the title ^^.</p>
  
  <p>Below is a little php code I did to test performance on my server ( + screenshot of the result ) and also show you how I intend to use very simply password_hash() and password_verify().</p>
  
  <p>I think I will go with PASSWORD_BCRYPT and cost = 11 what do you think ?</p>
  
  <pre><code>&lt;?php
  $startpage = microtime(true);
  $userPassword = "ILike5InchesIceCubes";
  echo "&lt;h2&gt;Password we work on :    " . $userPassword . "&lt;/h2&gt;&lt;/br&gt;&lt;/br&gt;";
  
  
  echo "&lt;b&gt;password_hash($userPassword, PASSWORD_BCRYPT) :&lt;/br&gt;&lt;/b&gt;";
  $start1 = microtime(true);
  $hash = password_hash($userPassword, PASSWORD_BCRYPT);
  echo "Hash is : " . $hash . "&lt;/br&gt;";
  echo "Encryption took : ". (microtime(true) - $start1) . " seconds &lt;/br&gt;";
  $start2 = microtime(true);
  password_verify($userPassword, $hash);
  echo "Password verification took : ". (microtime(true) - $start2) ." seconds &lt;/br&gt;&lt;/br&gt;";
  
  echo "&lt;b&gt;password_hash($userPassword, PASSWORD_DEFAULT) :&lt;/br&gt;&lt;/b&gt;";
  $start1 = microtime(true);
  $hash = password_hash($userPassword, PASSWORD_DEFAULT);
  echo "Hash is : " . $hash . "&lt;/br&gt;";
  echo "Encryption took : ". (microtime(true) - $start1) . " seconds &lt;/br&gt;";
  $start2 = microtime(true);
  password_verify($userPassword, $hash);
  echo "Password verification took : ". (microtime(true) - $start2) ." seconds &lt;/br&gt;&lt;/br&gt;";
  
  $cost = 4;
  do {
  
          echo "&lt;b&gt;password_hash($userPassword, PASSWORD_BCRYPT, [\"cost\" =&gt;" . $cost . "])&lt;/br&gt;&lt;/b&gt;";
      $start1 = microtime(true);
      $hash = password_hash($userPassword, PASSWORD_BCRYPT, ["cost" =&gt; $cost]);
          echo "Hash is : " . $hash . "&lt;/br&gt;";
          echo "Encryption took : ". (microtime(true) - $start1) ." seconds &lt;/br&gt;";
          $start2 = microtime(true);
          password_verify($userPassword, $hash);
          echo "Password verification took : ". (microtime(true) - $start2) ." seconds &lt;/br&gt;&lt;/br&gt;";
  
          $cost++;
  
  } while ($cost &lt;= 16);
  $endpage = microtime(true);
  
  echo "The whole page took : ". ($endpage - $startpage) . " seconds &lt;/br&gt;";
  ?&gt;
  </code></pre>
  
  <p><a href="https://i.stack.imgur.com/5hNW5.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/5hNW5.png" alt="enter image description here"></a></p>