Maximum length of generated hash when using password_hash?

问题

I'm using

password_hash($password, PASSWORD_BCRYPT);

for crypt password to store on a database. As i read, there's no lenght limit on generated hashes, but i need to put a limit for create a field on my database could fit all password (in worst case scenario). If i put a limit of 20 character for password in plain text, how password_hahs() result will be long?

回答1:

From the password_hash documentation:

The following algorithms are currently supported:

PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).

PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.

Therefore, using PASSWORD_BCRYPT, the result of password_hash will be a 60 character string.

回答2:

The result of BCrypt will always be a 60 character string. Limitless is only the input for the function, that means you do not (and should not) set a limit to the entered passwords.

Actually BCrypt internally uses only about 72 characters, but it accepts passwords of any length.

If you want to use the function in its future proof form like this (notice the PASSWORD_DEFAULT)...

password_hash($password, PASSWORD_DEFAULT);

...then you should make your database field bigger. Newer PHP versions may replace BCrypt with another default hash algorithm, which may generate longer hashes.

来源：https://stackoverflow.com/questions/21479655/maximum-length-of-generated-hash-when-using-password-hash