When increasing the algorithm cost for password hashing, does password_verify() still produce accurate results in PHP?

When increasing the algorithm cost for password hashing in PHP using functions like password_hash(), the cost parameter should also be passed to password_verify() in order to accurately verify the hashed password. This ensures that password_verify() uses the same cost factor when comparing the passwords. 

$hashedPassword = password_hash($password, PASSWORD_DEFAULT, ['cost' => 12]);

// Verify the password using the same cost factor
if (password_verify($password, $hashedPassword)) {
    echo 'Password is correct!';
} else {
    echo 'Password is incorrect!';
}

Keywords

password hashing algorithm cost password_verify() accuracy PHP

Related Questions