title: PHP password_hash() / bcrypt
body: <p>I am checking out the bcrypt hash-algorithm.</p>
  
  <p>My first test with password_hash():</p>
  
  <pre><code>echo password_hash("123", PASSWORD_BCRYPT, array( "salt" =&gt; "1234567890123456789012" ));
  echo password_hash("123", PASSWORD_BCRYPT, array( "salt" =&gt; "1234567890123456789012xxxxxxxxxxxxxxx" ));
  </code></pre>
  
  <p>Both will return '$2y$10$123456789012345678901uiaLpJxTpf6VbfI5NADlsRsfvEm6aq9C'.</p>
  
  <ol>
  <li>Why the heck is the salt stored inside of the hash? This makes no sense at all for me. A attacker who gets the hashes from a database can´t do anything with them, if he does not know the salt.</li>
  <li>Why do I get the same Hash with two different salts? Are only the first 22 chars used for the salt passed to the function?</li>
  </ol>
  
  <p>Thank you very much!</p>