Note that new hashing algorithms are mandated to only be added during major (x.0.0) or minor (x.y.0) releases. So for the lifetime of PHP 7.4, bcrypt is the default.

> I do a quick hash of the password before passing it into password_hash()
This decreases the overall security of the hash. Even if it's "boring cryptography", please don't do this. It's a matter of principle: don't hash hashes.

> "This decreases the overall security of the hash [...] don't hash hashes"

Not so for bcrypt... which is an old-ish hashing algorithm, with 2 fairly well known issues (fortunately they are also minor, so most programmers shouldn't care).

The quick hash before solves those issues (this is why Scott Arciszewski and Dropbox do it); but you are right in general, this would be bad for future algorithms (such as Argon2), and is why I only want to do this for bcrypt, while being ready for when PASSWORD_DEFAULT moves away from bcrypt.

Hi Craig,

I've just opened a PR in order to add the missing functionality: https://github.com/php/php-src/pull/5104

Don't hesitate to give feedback about the (preliminary) implementation.

Thanks kocsismate, I like your idea of matching `password_get_info()` with the ability to see the default options as well, that’s a really nice touch.

The ship is sailing in another direction... :) So it might be possible to fix the issue in a next minor version of PHP 7.4. See the discussion in the PR for context.

Thanks kocsismate, I think that works as well, and is better for backwards compatibility reasons.

But it might be worth keeping your idea for returning the default options at some point, not that I *need* it, but someone might (says he knowing that we should only add things to PHP that people will actually use).