password_hash means you stop inventing salts

Every hand-rolled password scheme gets the same three things wrong: the algorithm is too fast, the salt is reused or stored badly, and the comparison is not constant time. password_hash() handles all three and stores the algorithm, cost and salt inside the resulting string, so nothing else needs a column.

$hash = password_hash($plain, PASSWORD_DEFAULT);
// $2y$10$B3n1uZ...  — algorithm, cost and salt are all in there

if (password_verify($plain, $hash)) {
    if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
        $hash = password_hash($plain, PASSWORD_DEFAULT);
    }
}

The part people skip is password_needs_rehash(). Because the cost is baked into the hash, raising it later only affects new passwords unless you rehash on successful login — which is the one moment you legitimately have the plaintext. Store the result in a column of at least 255 characters; PASSWORD_DEFAULT is explicitly allowed to grow.