> Store password hashes using Bcrypt (no salt necessary - Bcrypt does it for you). In PHP, I would rather recommend to use password_hash() with its own default

> Store password hashes using Bcrypt (no salt necessary - Bcrypt does it for you). In PHP, I would rather recommend to use password_hash() with its own defaults since it's built-in and designed specifically for this purpose - and quite future-proof. But this is PHP specific. > [] Destroy all active sessions on reset password (or offer to). > ... > [] Destroy the logged in user's session everywhere after successful reset of password. I believe these are the same. The second one is clearer though. Edit: clarified