This is wrong and misleading

"Sensitive information such as passwords must be hashed using at least SHA1 or a stronger hashing algorithm like those implemented by the password_hash() function."

NO! You should NOT use SHA1 for passwords. This is a terrible idea.

Read this:

paragonie.com/blog/2015/08/you-woul ...

It says _atleast_ , but yes... SHA1 is a bad recommendation.

"At least X" implies X is acceptable.

The only acceptable answers are:

1. password_hash() and password_verify()
2. PECL scrypt
3. PECL libsodium

First of all, thank you so much for sharing your knowledge. Now, i have just mentioned there passwords must be hashed using at least SHA1 or a stronger hashing algorithm . It means that SHA1 is the least preferred choice. SHA1 and MD5 have limitations too. What i meant was passwords should always be validated using encrypting functions.

Yes, password_hash is more recommended not just because it uses stronger hashing algorithms but also because there is a cost factor that determines how many times the hashing should be applied, thus making it much more expensive to compute the hashes and find the original password with brute force methods.

The only matter about password_hash is that it requires PHP 5.5 and not everybody is on that PHP version yet.

Anyway, as moderator I have changed the text to not recommend SHA1 at all because soon or later everybody will be using PHP 7.

> It means that SHA1 is the least preferred choice.

NO! Saying "SHA1 is the least preeferred choice" is the same as saying "SHA1 is somewhere on the list (specifically the bottom) of acceptable choices". It isn't.

> What i meant was passwords should always be validated using encrypting functions.

NO! https://paragonie.com/blog/2015/08/you-wouldnt-base64-a-password-cryptography-decoded

Hashing is not encryption.

There are various encryption techniques. What we do by hashing is actually encryption. So i am not getting your point "Hashing is not encryption"