What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If password_verify() returns false, first check the exact password string and complete stored hash passed to it—and confirm the hash belongs to the account you looked up. The function returns true only when those values match. Common places to investigate are a wrong database row or field, different password transformations at registration and login, a truncated hash, or bcrypt’s 72-byte input limit. The title alone does not identify which cause applies; that depends on your code, stored value, algorithm and PHP version.
What password_verify() checks
The function takes the password string and the hash created for it, then returns a boolean:
password_verify($password, $hash)
Pass the submitted password as the first argument and the complete stored hash as the second. PHP’s password hashes contain the algorithm, cost and salt information, so you do not need to store those separately for verification. Do not generate a new hash and compare the two hash strings: salts mean hashes of the same password can differ. Use the stored hash with password_verify(). The PHP manual also states that the function is safe against timing attacks. PHP: password_verify()
Check the login lookup and stored hash first
Verify that the database query returns the intended user and the correct password-hash field. An empty result, a different account, or a similarly named field can make verification fail even when the person typed the password they expect.
#1 Best Overall
Check the full value returned by the database driver, not just what a formatted display shows. PHP notes that PASSWORD_DEFAULT may use a stronger algorithm over time, which can change hash length. Its manual recommends a database column that can expand beyond 60 bytes and says 255 bytes is a good choice. A truncated or altered hash will not be fixed by changing the verification call; inspect the actual schema and stored value to establish whether that happened. PHP: password_hash()
Compare registration and login inputs byte for byte
Trace how the password is handled when the account is created and when the user logs in. Both paths must use the intended password value, without applying different trimming, normalization, encoding conversion, prefixes or other transformations. Also check that login passes the stored password_hash() output directly to password_verify(), rather than hashing the submitted password again.
Rank #2
For debugging, inspect whether values are present and their types, plus the password’s byte length and the hash’s length. Avoid logging plaintext passwords or exposing live hashes. A displayed string or character count is not proof that the underlying byte sequences match, particularly when text contains multibyte characters.
If the hash uses bcrypt, check the 72-byte limit
PHP documents that PASSWORD_BCRYPT truncates the password parameter to a maximum of 72 bytes. This is a byte limit, not a visible-character limit: multibyte text can use more than one byte per character. If your application adds a secret or transforms the password before hashing, measure the resulting byte string on both registration and login. This documented limit is bcrypt-specific; do not assume it applies to every password-hashing algorithm. PHP: password_hash()
Use a safe debugging sequence
- Confirm the authentication query finds the intended account and returns its password-hash field.
- Check value presence and type, and compare password byte length and hash length without printing either secret.
- Trace registration and login side by side for differences in trimming, normalization, encoding, prefixes or extra hashing.
- Inspect the schema and the complete hash returned by the database driver; verify the column can hold the full value.
- Identify the hash algorithm and check its documented input behavior. If it is bcrypt, account for the 72-byte limit.
- Keep the verification pattern as
password_verify($submittedPassword, $storedHash); do not manually salt or compare freshly generated hashes as strings.
One separate security issue: leading NUL bytes
A PHP security advisory documents an edge case that caused an incorrect true, not the false result described here: on affected versions, a hash created from a password beginning with a NUL byte could verify an empty password. The advisory lists PHP versions below 8.1.28, 8.2.18 and 8.3.5 as affected, and identifies 8.1.28, 8.2.18 and 8.3.6 as patched releases for those branches. It was published April 11, 2024; these are advisory-specific historical versions, not a current upgrade recommendation. Check the current maintenance release for your PHP branch and patch accordingly, especially if your application accepts binary password input. PHP source repository security advisory
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
