title: Generating Password Hash In PHP 5.5 And Setting Cost Option
body: <p>I know PHP 5.5 is in alpha but this class I am making is just being made in advance to utilize it's hashing feature by using function_exists().</p>
  
  <p>I checked out the <a href="http://php.net/password_hash" rel="noreferrer"><code>password_hash</code></a> documentation.  The 3rd argument is for $options which currently supports two options, 'salt' and 'cost'.</p>
  
  <p>It states the following:</p>
  
  <blockquote>
    <p>cost, which denotes the algorithmic cost that should be used. Examples
    of these values can be found on the crypt() page.</p>
  </blockquote>
  
  <p>When I go to the crypt() page the documentation it gives is:</p>
  
  <blockquote>
    <p>Blowfish hashing with a salt as follows: "$2a$", "$2x$" or "$2y$", a
    two digit cost parameter, "$", and 22 digits from the alphabet
    "./0-9A-Za-z". Using characters outside of this range in the salt will
    cause crypt() to return a zero-length string. The two digit cost
    parameter is the base-2 logarithm of the iteration count for the
    underlying Blowfish-based hashing algorithmeter and must be in range
    04-31, values outside this range will cause crypt() to fail. Versions
    of PHP before 5.3.7 only support "$2a$" as the salt prefix: PHP 5.3.7
    introduced the new prefixes to fix a security weakness in the Blowfish
    implementation. Please refer to » this document for full details of
    the security fix, but to summarise, developers targeting only PHP
    5.3.7 and later should use "$2y$" in preference to "$2a$".</p>
  </blockquote>
  
  <p>I can't seem to get my head wrapped around this. It says PHP 5.3.7 and later should use $2y$, but what cost value do I use to get that one and is it the best value to choose? The example they provide uses a value of 7, but according to the above it can go up to 31, what difference does it make to use say 4 opposed to say 31?</p>