PHP Password Hashing in 2026: password_hash and Nothing Else
md5 and sha1 are still in production codebases, usually behind a salt somebody was proud of. What password_hash actually does, why the salt argument is gone, how to rehash on login, and the comparison that leaks.
Read article
