How to Encrypt and Decrypt a PHP String?

Encrypting and decrypting strings is a common requirement in PHP applications, especially when dealing with sensitive data like passwords or personal information.

Encryption is the process of converting plaintext data into a secure format, while decryption is the process of converting the encrypted data back to its original form.

In this article, we'll explore how to encrypt and decrypt a PHP string using various methods.

1. Using the openssl_encrypt() and openssl_decrypt() Functions

PHP provides the openssl_encrypt() and openssl_decrypt() functions to handle encryption and decryption. These functions use the OpenSSL library, which is a widely-used and secure cryptography library.

Encryption with openssl_encrypt()

Here's an example of how to encrypt a string using openssl_encrypt():

$data = "Sensitive information";
$encryptionMethod = "AES-256-CBC";
$secretKey = "MySecretKey"; // Replace with your secret key
$iv = random_bytes(16); // Generate a random IV (Initialization Vector)

$encryptedData = openssl_encrypt($data, $encryptionMethod, $secretKey, 0, $iv, $tag);

In this example:

Decryption with openssl_decrypt()

To decrypt the encrypted data, use openssl_decrypt():

$decryptedData = openssl_decrypt($encryptedData, $encryptionMethod, $secretKey, 0, $iv, $tag);

echo $decryptedData;

In this example:


2. Using password_hash() and password_verify()

For securely storing and verifying user passwords, PHP provides the password_hash() and password_verify() functions, which use bcrypt, a strong password hashing algorithm.

Hashing a String with password_hash()

Here's an example of how to hash a string using password_hash():

$password = "SecurePassword";

// Hash the password using bcrypt
$hashedPassword = password_hash($password, PASSWORD_BCRYPT);

echo $hashedPassword;

Verifying a Password with password_verify()

To verify a password, use password_verify():

$enteredPassword = "SecurePassword"; // The user's entered password

// Verify the entered password against the hashed password
if (password_verify($enteredPassword, $hashedPassword)) {
    echo "Password is correct.";
} else {
    echo "Password is incorrect.";

In this example, password_verify() compares the entered password with the stored hashed password.

3. Using a Third-Party Library (Libsodium)

If you prefer a more comprehensive cryptographic library, you can use Libsodium, a modern, easy-to-use software library for encryption, decryption, signatures, password hashing, and more. Libsodium is not included in the PHP core, so you'll need to install it separately.

Here's an example of how to use Libsodium for encryption and decryption:

// Load the Libsodium library
if (extension_loaded('sodium')) {

    $message = "Secret message";

    // Encrypt the message
    $nonce = random_bytes(SODIUM_CRYPTO_SECRETBOX_NONCEBYTES);
    $key = sodium_crypto_secretbox_keygen();
    $ciphertext = sodium_crypto_secretbox($message, $nonce, $key);

    // Decrypt the message
    $decryptedMessage = sodium_crypto_secretbox_open($ciphertext, $nonce, $key);

    echo $decryptedMessage;
} else {
    echo "Libsodium is not installed.";


Encrypting and decrypting strings in PHP is a crucial aspect of securing sensitive data. Whether you use the built-in openssl_encrypt() and openssl_decrypt() functions, the password hashing functions password_hash() and password_verify(), or a third-party library like Libsodium, it's essential to follow best practices for handling keys and secrets, and to choose the method that best suits your security requirements. Properly securing sensitive information is critical in any PHP application.