php - Why is password_verify returning false?

Solution:

There are a variety of reasons why could be returning false, it can range from the setup of your table to the actual comparing of the password, below are the common causes of it failing.

<?php

$hashed = password_hash('test', PASSWORD_DEFAULT);
$password = 'test';

if (password_verify($password, $hashed)) {
  echo 'success';
} else {
  echo 'fail';
}

?>
Copy code

Repl

Hardcoded Passwords

In the instance that you are using a hardcoded hash and you are facing issues, ensure that you are using single quotes instead of double quotes when storing the value in the variable as the$ will be interpreted in when using double quotes:

<?php
// Undefined variable: QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu :1
$incorrect = "$2y$10$QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu";

$correct = '$2y$10$QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu';
?>
Copy code

Repl - Comment out respectively.

Addendum

As per the documentation:

Caution It is strongly recommended that you do not generate your own salt for this function. It will create a secure salt automatically for you if you do not specify one.

As noted above, providing the salt option in PHP 7.0 will generate a deprecation warning. Support for providing a salt manually may be removed in a future PHP release.

Solution:

Check the parameters order

Just to point something that happened to me, who was reading this same topic trying to solve my problem minutes ago, and can help you to solve the problem as well.
See if you are giving the parameters for password_verify() in the right order:

password_verify(string $password, string $hash)

password is the password you received by post or other method and are trying to validate.

hash is the hash that you want to compare the password to.(e.g. The password hash stored in your Data Base)

It happened to me that I inverted the order of the parameters, so the result wasn't coming as I expected to.

Solution:

Simple steps to debug the issue:

1. Print out and write down exact values of the raw password and the hash during the registration phase. Something like

    var_dump($password);
    $hash = password_hash($password, PASSWORD_DEFAULT);
    var_dump($hash);
   Copy code

   then copy and paste the output into some text file.

2. Print out and write down exact values of the password provided during login phase and the hash returned from DB. Something like

    var_dump($password);
    var_dump($row['password']);
    if(password_verify($password, $row['password'])) ...
   Copy code

And then simply compare those values. Ifpassword_verify() fails, either raw passwords or hashes don't match. If raw passwords don't match then the entered password is either incorrect or was maimed during some useless "sanitization". If the hash returned from DB doesn't match, then it either was maimed during some useless "sanitization" or it was changed due to incorrect column properties in the database.