I was confused by the password hashing example since it doesn't appear to use a salt (which was the main reason to implement it at all). Even more confusing, th

I was confused by the password hashing example since it doesn't appear to use a salt (which was the main reason to implement it at all). Even more confusing, the RCF says it will auto generate a salt if none is passed. The explanation, a bit further down in the eRFC is that the function password_hash doesn't actually return a password hash, but a string including the algorithm and options used, the salt and the hash itself. From the RFC: > It's important to note that the output of crypt() (and hence password_hash()) contains all the information that will be needed to verify the hash later. Therefore, if the default hashing algorithm changes, or the user changes their algorithm, old hashed passwords would still continue to function and will be validated properly.