title: How can password_verify validate passwords without knowing salt and cost?
body: <p>The function <a href="http://www.php.net/manual/en/function.password-verify.php" rel="noreferrer">password_verify()</a> in the new PHP password API checks if the password corresponds to the hash. The hash is generated by <a href="http://www.php.net/manual/en/function.password-hash.php" rel="noreferrer">password_hash()</a>, that by default uses a random salt and a <code>cost = 10</code>.</p>
  
  <p>I always thought (although I never studied it) that you have to store the salt inside the database and then when you want to verify the password, hash it with the given salt using the same cost. How can <code>password_verify()</code> check the password without knowing salt and cost?</p>