<?php
# Based on example at https://www.php.net/manual/en/function.password-needs-rehash
# This proves that PHP's password_needs_rehash returns true if the cost has changed in any way (i.e. also if it has become smaller).
mb_internal_encoding('UTF-8');
ini_set('default_charset', mb_internal_encoding());
$password = 'rasmuslerdorf';
# cost is 10 here:
$hash = '$2y$10$YCFsG6elYca568hBi2pZ0.3LDL5wjgxct1N8w/oLR/jfHsiQwCqTS';
if (!password_verify($password, $hash)) {
        die("password_verify failed with given hash!\n");
}
# The cost parameter can change over time as hardware improves
$options = ['cost' => 11];
$costs_to_try = [
        9,
        10,
        11,
];
foreach ($costs_to_try as $cost) {
        $options = ['cost' => $cost];
        $needs_rehash = password_needs_rehash($hash, PASSWORD_BCRYPT, $options);
        print "Does using cost=$cost require a rehash?: " . ($needs_rehash ? 'yes' : 'no') . "\n";
        if ($needs_rehash) {
                $new_hash = password_hash($password, PASSWORD_BCRYPT, $options);
                print "\tNew hash: $new_hash\n";
        }
}