On 05/10/2026 16:38, Tim Düsterhus wrote:
`rounds` and `cost` are the same thing. The format calls it `rounds`, but the PHP API calls it `cost`. Keeping `cost` on the PHP API makes sense to me for consistency with `PASSWORD_BCRYPT`, even if it is inconsistent with the hash string.Thank you for the explanation. This inconsistency made me believe there may be several rounds of sha256 too
