I\'ve been reading Stack Overflow questions for about 15 minutes now and every single one seems to contradict the previous one I read. Bcrypt, SHA1, MD5, and so on. I currently
When a user registers, create a random salt
using, for example, the following function:
$bytes = 50;
$salt = base64_encode(openssl_random_pseudo_bytes($bytes));
Store this in a database table. The best is to store it in an external database. After this, create a random code and store it together with your salt into the external database. Than store the random code in your users table and it will almost be impossible for an attacker to find your salt.
After this, store your password in, for example, this way:
$password_to_store_in_mysql = hash('sha512', $salt . $user_password);
When a user logs in, get the salt out of the external database en check if the salt and the password match.