Determining if my password hashing method is safe

Question

I've been reading through and I'm a bit confused about storing passwords and how people can crack them. The safest way seems to be a very confusing topic for me. I started using md5 and after reading how outdated it is I started using the php_hash function like so

$hash = password_hash($plainTextPassword, PASSWORD_DEFAULT);

I've been told to hash it again using salt and I understand how to do it. My question is why would one need to rehash their password? Most people just copy the code and use it not knowing why it's appropriate but for future purposes I'd like to know how do you know if the method you use for hashing your password is "hackable"?

Answer 1

I've been told to hash it again using salt…

What you have been told is wrong . Ignore whoever told you that.

The PHP password_hash() API is not a plain hash function; it already performs all the appropriate steps for hashing a password itself, including adding a salt. Don't add anything to it; just use it as-is.