php - 使用 password_hash 时生成的哈希的最大长度？

Question

我在用

password_hash($password, PASSWORD_BCRYPT);

加密密码以存储在数据库中。正如我所读，生成的哈希值没有长度限制，但我需要知道最大长度，以便我可以使用它来定义我的数据库中可以适合所有密码哈希值的字段(在最坏的情况下)。

如果我将明文密码的长度限制为 20 个字符，password_hash() 结果会是多长时间？

Answer 1

来自password_hash documentation :

The following algorithms are currently supported:

PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).

PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.

因此，使用PASSWORD_BCRYPT，password_hash的结果将是一个60个字符的字符串。