Title: WP_Application_Passwords::check_password
Published: April 28, 2025
Last modified: August 20, 2026

---

# WP_Application_Passwords::check_password( string $password, string $hash ): bool

## In this article

 * [Parameters](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#parameters)
 * [Return](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#return)
 * [Source](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#source)
 * [Related](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#related)
 * [Changelog](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#changelog)

[ Back to top](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#wp--skip-link--target)

Checks a plaintext application password against a hashed password.

## 󠀁[Parameters](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#parameters)󠁿

 `$password`stringrequired

Plaintext password.

`$hash`stringrequired

Hash of the password to check against.

## 󠀁[Return](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#return)󠁿

 bool Whether the password matches the hashed password.

## 󠀁[Source](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#source)󠁿

    ```php
    public static function check_password(
    	#[\SensitiveParameter]
    	string $password,
    	string $hash
    ): bool {
    	if ( ! str_starts_with( $hash, '$generic$' ) ) {
    		/*
    		 * If the hash doesn't start with `$generic$`, it is a hash created with `wp_hash_password()`.
    		 * This is the case for application passwords created before 6.8.0.
    		 */
    		return wp_check_password( $password, $hash );
    	}

    	return wp_verify_fast_hash( $password, $hash );
    }
    ```

[View all references](https://developer.wordpress.org/reference/files/wp-includes/class-wp-application-passwords.php/)
[View on Trac](https://core.trac.wordpress.org/browser/tags/7.1/src/wp-includes/class-wp-application-passwords.php#L500)
[View on GitHub](https://github.com/WordPress/wordpress-develop/blob/7.1/src/wp-includes/class-wp-application-passwords.php#L500-L514)

## 󠀁[Related](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#related)󠁿

| Uses | Description | 
| [wp_verify_fast_hash()](https://developer.wordpress.org/reference/functions/wp_verify_fast_hash/)`wp-includes/functions.php` |

Checks whether a plaintext message matches the hashed value. Used to verify values hashed via [wp_fast_hash()](https://developer.wordpress.org/reference/functions/wp_fast_hash/) .

  | 
| [wp_check_password()](https://developer.wordpress.org/reference/functions/wp_check_password/)`wp-includes/pluggable.php` |

Checks a plaintext password against a hashed password.

  |

| Used by | Description | 
| [wp_authenticate_application_password()](https://developer.wordpress.org/reference/functions/wp_authenticate_application_password/)`wp-includes/user.php` |

Authenticates the user using an application password.

  |

## 󠀁[Changelog](https://developer.wordpress.org/reference/classes/wp_application_passwords/check_password/?output_format=md#changelog)󠁿

| Version | Description | 
| [6.8.0](https://developer.wordpress.org/reference/since/6.8.0/) | Introduced. |

## User Contributed Notes

You must [log in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fdeveloper.wordpress.org%2Freference%2Fclasses%2Fwp_application_passwords%2Fcheck_password%2F)
before being able to contribute a note or feedback.