Why is password_verify returning false?
Solution 1
Probably the problem is with your column length, from the manual: it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice). link
Solution 2
There are a variety of reasons why password_verify
could be returning false, it can range from the setup of your table to the actual comparing of the password, below are the common causes of it failing.
Column Setup
-
The length of the password column in your table is too short:
- If you are using
PASSWORD_DEFAULT
then it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice). - If you are using
PASSWORD_BCRYPT
then it is recommended to store the result in a database column that is 60 characters becausePASSWORD_BCRYPT
will always result in a 60 character string or FALSE on failure.
- If you are using
Password Sanitization
Another common cause is when developers try to "clean" the user's password to prevent it from being malicious, as a result, this causes the input to be different to what is being stored in the table. It is not even necessary to escape the input, you should use prepared statements instead. You shouldn't even trim
the passwords as that could change that which was originally provided.
Password Verification
When using password_verify
you need to compare the plaintext password with the hash from the database, not compare hashes (the implication here being that you need to have stored the hashed password of the user when they register):
<?php
$hashed = password_hash('test', PASSWORD_DEFAULT);
$password = 'test';
if (password_verify($password, $hashed)) {
echo 'success';
} else {
echo 'fail';
}
?>
Hardcoded Passwords
In the instance that you are using a hardcoded hash and you are facing issues, ensure that you are using single quotes instead of double quotes when storing the value in the variable as the $
will be interpreted in when using double quotes:
<?php
// Undefined variable: QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu :1
$incorrect = "$2y$10$QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu";
$correct = '$2y$10$QHpfI0MfQWjvsVQWRdFHSOX6WqG8LSf0iFGiKs0Fz0RvqhpFOpAKu';
?>
Repl - Comment out respectively.
Addendum
As per the documentation:
Caution It is strongly recommended that you do not generate your own salt for this function. It will create a secure salt automatically for you if you do not specify one.
As noted above, providing the salt option in PHP 7.0 will generate a deprecation warning. Support for providing a salt manually may be removed in a future PHP release.
Lucca Zenobio
Updated on June 20, 2022Comments
-
Lucca Zenobio almost 2 years
I'm using a
password_verify
to check my hashed password. I have PHP 5.5:$this->db_connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME); // if no connection errors (= working database connection) if (!$this->db_connection->connect_errno) { // escape the POST stuff $user_name = $this->db_connection->real_escape_string($_POST['user_name']); // database query, getting all the info of the selected user (allows login via email address in the // username field) $sql = "SELECT user_name, user_email, user_password_hash FROM users WHERE user_name = '" . $user_name . "' OR user_email = '" . $user_name . "';"; $result_of_login_check = $this->db_connection->query($sql); // if this user exists if ($result_of_login_check->num_rows == 1) { // get result row (as an object) $result_row = $result_of_login_check->fetch_object(); // using PHP 5.5's password_verify() function to check if the provided password fits // the hash of that user's password if (password_verify($_POST['user_password'], $result_row->user_password_hash)) { // write user data into PHP SESSION (a file on your server) $_SESSION['user_name'] = $result_row->user_name; $_SESSION['user_email'] = $result_row->user_email; $_SESSION['user_login_status'] = 1;
I'm getting
false
onpassword_verify
. I've already checked the posts value and mysql user_password_hash return.I don't know why it's returning false
Any ideas?
-
Ashesh about 9 yearsit would be better to use
CHAR
data type for the hashed password field in the database and set 60 as its length on usingPASSWORD_BCRYPT
constant. In this case the hash will always be 60 characters long. -
João Pedro Schmitz over 5 yearsJust adding a problem that I had: when I was generating the password hash on the HTML I always copied with a space on the end, so it never worked.