password_hash() is the recommended function in PHP to generate password hashes. The standard usage is password_hash($password, PASSWORD_DEFAULT); and default hash with PASSWORD_DEFAULT is bcrypt. The benefit is using the built-in password_verify() and password_needs_rehash() functions in PHP.
I was wondering if SHA3-512 with unsalted hashes, hash("sha3-512", $password); would be better, worse or as good as the password_hash option.
For passwords, bcrypt is a much better option that SHA-3. SHA-3 and bcrypt serve different purposes. BCrypt is a Key-Derivation Function, while SHA-3 is a regular hash. KDFs are deliberately more computationally intensive than standard has functions. The slower a hashing function is, the longer it takes to crack. This helps protect against offline attacks in the event the hashes are stolen.
The below article can give you a good overview as to the threat you are trying to defend against.
https://arstechnica.com/information-technology/2012/08/passwords-under-assault/
Unsalted SHA3 is a terrible choise for password hashing. Go with bcrypt instead.
First, you want password hash functions to be slow so that brute forcing is slow. Bcrypt is designed to be slow. SHA3 is designed to be fast.
Second, you always want to use a salt. The salt forces the attacker to attack one password at a time instead of all at once. You want that.
