The PHP docs make a pretty clear statement: PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). (from https://www.php.net/manual/en/fu

The PHP docs make a pretty clear statement: PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). (from https://www.php.net/manual/en/function.password-hash.php https://www.php.net/manual/en/function.password-hash.php) and then there's also the source code: https://github.com/php/php-src/blob/bf92bddb878dbd86d23db2900bad1cdfcd449eb7/ext/standard/password.c#L467-L469 https://github.com/php/php-src/blob/bf92bddb878dbd86d23db290...