Question: The [PHP manual](http://php.net/manual/en/function.password-hash.php) implies that using PASSWORD\_DEFAULT is more robust since the hashing algorithm will be kept up-to-date as newer versions of PHP are released.

However, it doesn't mention if old hashes will fail after the hashing algorithm is updated. Presumably they would, since the hashes would be different. However this seems pretty unfriendly to unsuspecting devs and no warning is given on the matter.

Does PHP handle this gracefully behind the scenes somehow or would an update to PHP's PASSWORD\_DEFAULT force all my users to change their password?

Answer: 
They will still work. Check out the documentation on [`password_verify`](http://php.net/manual/en/function.password-verify.php), emphasis mine:

> 
> Note that password\_hash() returns the algorithm, cost and salt as part
>  of the returned hash. **Therefore, all information that's needed to
>  verify the hash is included in it.**
> 
> 
> 

So, the old hashes still contain the information needed to verify them within the hash itself. On verification, if an older hash is supplied, its verified against the older algorithm. The same is true for a hash with a newer algorithm.
No they won't fail, because the generated hash value actually contains the algorithm, salt, cost, etc as part of the encoding, so password\_verify() knows how to validate using the correct algorithm and other details