WordPress Password Hash Generator & Checker

About the WordPress Password Hash Generator & Checker

Locked out of a WordPress site but still able to reach its database (phpMyAdmin, Adminer or your host’s database tool)? Type a new password here and get the hash in the format your WordPress version stores, plus the UPDATE statement for the users table with your table prefix and user name. Paste it into the SQL tab, run it, and sign in with the new password.

WordPress 6.8 and later store $wp$2y$… hashes: bcrypt over a SHA-384 pre-hash of the password, which this page computes exactly as WordPress core’s wp_hash_password() does. Older versions store phpass $P$… hashes, which current versions still accept. The Check tab tells you which format a user_pass value is in — $wp$, $P$, plain bcrypt $2y$ or a legacy 32-character MD5 — and whether a password matches it. The password never leaves your browser.

Common uses

• Getting back into a WordPress admin when the password reset e-mail never arrives.
• Resetting a client’s or a staging site’s administrator password from the hosting panel’s database tool.
• Checking which hashing format a migrated or cloned site uses before switching WordPress versions or login plugins.
• Confirming that a password stored for a test user really matches its hash.

The formats WordPress reads

• **$wp$2y$10$… or $wp$2y$12$… (63 characters)** — WordPress 6.8 and later. The password, with spaces at the ends removed, is pre-hashed with HMAC-SHA384 under the key wp-sha384, the result is base64-encoded, and PHP’s password_hash() hashes that with bcrypt; $wp is put in front. The cost is PHP’s default: 10 before PHP 8.4, 12 from PHP 8.4 (PHP manual).
• **$P$B… (34 characters)** — phpass portable hashes, which WordPress wrote before 6.8: MD5 of an 8-character salt and the password, then 8,192 more rounds of MD5.
• **$2y$… (60 characters)** — plain bcrypt written by some security plugins; checked with password_verify(), which uses only the first 72 bytes of a password.
• 32 hexadecimal characters — a legacy MD5 hash (or one set with MD5() in SQL). WordPress compares any value of 32 characters or fewer with the MD5 of the password.

WordPress 6.8 and later replace phpass, plain bcrypt and MD5 hashes with a $wp$ hash the next time the user signs in. Sources: WordPress core’s wp_hash_password() and wp_check_password() and class-phpass.php, and the WordPress 6.8 bcrypt announcement.

Without phpMyAdmin

With shell access, WP-CLI sets a password directly: wp user update admin --user_pass="new password" (it hashes it the way your WordPress version does; clear your shell history afterwards). In Adminer or a host’s own database tool, open the users table with your prefix (for example wp_users), edit the row of your account and paste the hash into user_pass instead of running the SQL.

After a lock-out or a hack

If someone else changed your password, a new password alone is not enough: check the list of administrator accounts for ones you do not know, update WordPress, themes and plugins, and replace the authentication keys and salts in wp-config.php so every existing sign-in is ended (the wp-config.php Generator makes a new set). Use a long, unique password and turn on two-step sign-in with a plugin you trust.

Limitations

• This page makes and checks hashes; it does not connect to your database or your site. You run the SQL yourself.
• It cannot recover a password from a hash: bcrypt and phpass are one-way. It only tells you whether a password you type matches.
• phpass hashes with more than 2^24 rounds are not checked here (WordPress writes 2^13).
• Sites that replace WordPress’s password functions with a plugin (an older bcrypt plugin, an Argon2 filter, single sign-on) may store other formats; Argon2 hashes from PHP are checked, others are named as unknown.

Privacy

On this device: nothing is sent

Passwords and hashes are processed in your browser (bcrypt runs in a background worker) and are never sent, logged or stored.