title: Is php's own hash framework better than phpass
body: <p>Until now, and I haven't used it much, I've been using the hasher found over at <a href="http://www.openwall.com/phpass" rel="nofollow noreferrer">phpass</a>.  Then I read another post, "<a href="https://stackoverflow.com/questions/8283653/forget-password-page-creating-a-generated-password-to-email-to-the-user">forget password page, creating a generated password to email to the user.</a>", here at stackoverflow written by <a href="https://stackoverflow.com/users/694286/nageeb">nageeb</a>.</p>
  
  <p>Excerpt from his post:</p>
  
  <blockquote>
    <p>Here's a step-by-step method that I use:</p>
    
    <p>User creates password (via a registration form)
    A function creates a random salt and then encrypts the password, in this case, using SHA256 algorithm and using a randomly created salt.</p>
    
    <p><strong>$password_salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));</strong></p>
    
    <p><strong>$password_hash = hash('sha256', $salt . $password);</strong></p>
    
    <p>Save the $password_hash and the $password_salt to the users table. These will be used later to authenticate the user when they attempt to login in the future.</p>
    
    <p>When the user logs in, check the username/email/login and if found, grab the hash and salt from the users table and compare the password hash from the db to the hash returned from performing the same function on what they entered as their password.</p>
    
    <p><strong>$salt = $user_record['password_salt'];</strong></p>
    
    <p><strong>$entered_hash = hash('sha256', $salt . $entered_password);</strong></p>
  </blockquote>
  
  <p>Here it looks like php have native functions for all hashing needs.  This make me think it must be the better one.  Should I stop using phpass and start using the php hash framework?</p>