I am creating a simple Sign up and Sign in form using PHP. At the sign up, I create hash using password_hash() function and then store it in the DB. At the time of Sign in, initially what I did was created a new hash using password_hash() function again and then compared it with the stored Password hash.
This failed all the time because as I understand now, a new salt is used every time you create a password hash using the password_hash() function. After researching, I got to know that one should be using PHP function password_verify(<plain_text_password>,<password_fetched_from_DB>).
What I don't understand is how come password_verify function knows the salt value that was used earlier at the time of sign up? If the salt is not known then password_verify should also fail like password_hash function when used for comparison.
I read about it further and what I got to know is that when password_hash() function is used to create the hash, it also stores the salt value inside of the hash? For instance, if hash created is abcde12345, then could 12345 be the salt value?
If this is true, then by looking at a hash can we tell that "this" part of hash is actually the salt value? Is the salt value always placed at certain position in the hash? I would appreciate if someone can share an example.