Hacker News Reader

Just noting if you're new to this you don't have to add a salt, by default password_hash with bcrypt will add a random one to each password.

Assuming the RNG isn't duff, which PHP has stumbled on a few times in the past, with session keys and such.

Check it out for yourself. Here's the random generating parts, pulled out for you: http://stackoverflow.com/questions/14673005/how-does-phps-pa...

How does that work? Don't you need the original salt to verify the hash?

The salt is stored in the hash itself, so it can extract the salt from any provided hash. (Neat huh?)

Here's a quick explanation of the format, in case anybody's interested: