wp_hash_password() – Function | Developer.WordPress.org

Creates a hash of a plain text password.

Description

For integration with other applications, this function can be overwritten to instead use the other package password hashing algorithm.

Parameters

$passwordstringrequired: Plain text user password to hash.

More Information

This function can be replaced via plugins. If plugins do not redefine these functions, then this will be used instead.

Creates a hash of a plain text password. Unless the global $wp_hasher is set, the default implementation uses PasswordHash, which adds salt to the password and hashes it with 2**8 = 256 passes of MD5. MD5 is used by default because it’s supported on all platforms. You can configure PasswordHash to use Blowfish or extended DES (if available) instead of MD5 with the $portable_hashes constructor argument or property (see examples).

Source

function wp_hash_password( $password ) {
	global $wp_hasher;

	if ( empty( $wp_hasher ) ) {
		require_once ABSPATH . WPINC . '/class-phpass.php';
		// By default, use the portable hash from phpass.
		$wp_hasher = new PasswordHash( 8, true );
	}

	return $wp_hasher->HashPassword( trim( $password ) );
}

View all references View on Trac View on GitHub

Used by	Description
WP_Application_Passwords::create_new_application_password()`wp-includes/class-wp-application-passwords.php`	Creates a new application password.
wp_set_password()`wp-includes/pluggable.php`	Updates the user’s password with a new hashed one.
wp_check_password()`wp-includes/pluggable.php`	Checks a plaintext password against a hashed password.
wp_update_user()`wp-includes/user.php`	Updates a user in the database.
wp_insert_user()`wp-includes/user.php`	Inserts a user into the database.

Changelog

Version	Description
2.5.0	Introduced.

User Contributed Notes

Codex 9 years ago

Compare an already hashed password with its plain-text string:

<?php
$wp_hasher = new PasswordHash(8, TRUE);

$password_hashed = '$P$B55D6LjfHDkINU5wF.v2BuuzO0/XPk/';
$plain_password = 'test';

if($wp_hasher->CheckPassword($plain_password, $password_hashed)) {
    echo "YES, Matched";
} else {
    echo "No, Wrong Password";
}
?>

Skip to note 4 content

Codex 9 years ago

You must log in to vote on the helpfulness of this noteVote results for this note: 1You must log in to vote on the helpfulness of this note
Use Blowfish or extended DES (if available) instead of MD5 to hash the password with 16 rounds of hashing:
```
$wp_hasher = new PasswordHash(16, FALSE);
$hashedPassword = wp_hash_password($password);
```
Log in to add feedback

wp_hash_password( string $password ): string

In this article