Verify a password without hashing the submitted value for comparison

Two calls to password_hash for the same password normally produce different strings because the hash includes a salt. Comparing a newly generated hash to the stored hash therefore rejects a correct password.

Let the password API verify it

<?php
$stored = password_hash('an-example-passphrase', PASSWORD_DEFAULT);
assert(password_verify('an-example-passphrase', $stored));
assert(!password_verify('incorrect', $stored));

The stored string contains information needed by the verifier. Keep sufficient database space for future algorithm changes; a field sized only for today's hash length is an avoidable migration problem. Do not log the submitted password or the stored hash when investigating a failed login.

Updating the hash is a separate step

After successful verification, password_needs_rehash can identify hashes that no longer match your selected algorithm or cost. Rehash the known-correct submitted password and replace the stored value. You cannot upgrade an old hash by hashing the hash itself.

In Laravel, use its authentication and Hash facilities rather than rebuilding the entire login flow around this standalone example. Password checking is only one part: throttling, session regeneration, reset tokens, and account policies still matter.

Test a correct password, a wrong password, and an old hash that needs an upgrade. Keep expensive hashing out of broad test fixtures where it is irrelevant, but retain a focused test using the real hashing implementation. A mock that always reports success does not verify credential handling.

Reference

Official documentation. The examples here illustrate the stated boundary; adapt them to your application and test its failure paths.