Re: [PHP-DEV] Binary (un)safety of password_hash() used with PASSWORD_BCRYPT

[Kamil Tekiela]

We can also consider switching the default to Argon2id.
As Scott says the NUL byte truncation is not a bug in PHP, but a bug in the
algorithm. I don't know the exact specification but maybe we should leave
the current implementation as is?