wp_check_password() – Function | Developer.WordPress.org

Checks a plaintext password against a hashed password.

Description

Maintains compatibility between old version and the new cookie authentication protocol using PHPass library. The $hash parameter is the encrypted password and the function compares the plain text password when encrypted similarly against the already encrypted password to see if they match.

For integration with other applications, this function can be overwritten to instead use the other package password hashing algorithm.

Parameters

$passwordstringrequired: Plaintext user’s password.
$hashstringrequired: Hash of the user’s password to check against.
$user_idstring|intoptional: User ID.
Default:''

Return

bool False, if the $password does not match the hashed password.

More Information

This function can be replaced via plugins. If plugins do not redefine these functions, then this will be used instead.

Source

function wp_check_password( $password, $hash, $user_id = '' ) {
	global $wp_hasher;

	// If the hash is still md5...
	if ( strlen( $hash ) <= 32 ) {
		$check = hash_equals( $hash, md5( $password ) );
		if ( $check && $user_id ) {
			// Rehash using new hash.
			wp_set_password( $password, $user_id );
			$hash = wp_hash_password( $password );
		}

		/**
		 * Filters whether the plaintext password matches the encrypted password.
		 *
		 * @since 2.5.0
		 *
		 * @param bool       $check    Whether the passwords match.
		 * @param string     $password The plaintext password.
		 * @param string     $hash     The hashed password.
		 * @param string|int $user_id  User ID. Can be empty.
		 */
		return apply_filters( 'check_password', $check, $password, $hash, $user_id );
	}

	/*
	 * If the stored hash is longer than an MD5,
	 * presume the new style phpass portable hash.
	 */
	if ( empty( $wp_hasher ) ) {
		require_once ABSPATH . WPINC . '/class-phpass.php';
		// By default, use the portable hash from phpass.
		$wp_hasher = new PasswordHash( 8, true );
	}

	$check = $wp_hasher->CheckPassword( $password, $hash );

	/** This filter is documented in wp-includes/pluggable.php */
	return apply_filters( 'check_password', $check, $password, $hash, $user_id );
}

View all references View on Trac View on GitHub

Hooks

apply_filters( ‘check_password’, bool $check, string $password, string $hash, string|int $user_id ): Filters whether the plaintext password matches the encrypted password.

Uses	Description
wp_set_password()`wp-includes/pluggable.php`	Updates the user’s password with a new hashed one.
wp_hash_password()`wp-includes/pluggable.php`	Creates a hash of a plain text password.
apply_filters()`wp-includes/plugin.php`	Calls the callback functions that have been added to a filter hook.

Show 1 more Show less

Used by	Description
wp_authenticate_application_password()`wp-includes/user.php`	Authenticates the user using an application password.
wp_authenticate_email_password()`wp-includes/user.php`	Authenticates a user using the email and password.
wp_authenticate_username_password()`wp-includes/user.php`	Authenticates a user, confirming the username and password are valid.

Changelog

Version	Description
2.5.0	Introduced.

User Contributed Notes

Skip to note 2 content

Codex 9 years ago

You must log in to vote on the helpfulness of this noteVote results for this note: 3You must log in to vote on the helpfulness of this note
Example
```
$user = get_user_by( 'login', $username );
if ( $user && wp_check_password( $pass, $user->data->user_pass, $user->ID ) ) {
	echo "That's it";
} else {
	echo "Nope";
}
```
Log in to add feedback

wp_check_password( string $password, string $hash, string|int $user_id = ” ): bool

In this article