Is safe to use password_hash with unicode characters?

Question

Is safe to use password_hash with unicode characters like following or there are incompatibility problems?

<?php
$hash = password_hash("漢字", PASSWORD_DEFAULT);
?>

Answer 1

The hashing algorithms themselves work on bytes, so they are unicode safe, as Mark commented. The only issue might be PHP's handling of unicode strings, i.e. are the password hashing functions binary-safe? Let's test it and find out:

<?php

$pass = 0;
$fail = 0;

# Generate 100 random unicode passwords
for ($i = 0; $i < 100; $i++) {
    $password = '';
    for ($p = 0; $p < 10; $p++) {
        $password .= mt_rand(0xa1, 0xffff);
    }

    # Test password hashing
    $hash = password_hash($password, PASSWORD_DEFAULT);
    if (password_verify($password, $hash)) {
        $pass++;
    } else {
        $fail++;
    }
}

echo "Pass: $pass\nFail: $fail\n";

Result:

Pass: 100
Fail: 0

The answer to your question is yes, it's safe.