title: Is PHP password_verify really secure? Add another salt?
body: <p>I've been reading about how it works and it's really cool in how it slows down bruteforce attempts however it still doesn't feel secure.</p>
  
  <p>Lets say someone stole my database data including all my user password hashes, and knows that I used <code>password_hash</code> to hash my passwords. Can't he just loop through my passwords with his dictionary and <code>password_verify</code> to gain access?</p>
  
  <p>Is it good practice to add another salt before hashing the password?</p>