Wordpress Hash Generator

Historically WordPress used PHPass ($P$ portable hash format) in versions before 5.0. Modern WordPress installations (5.0+) with PHP 7.2+ support bcrypt ($2y$ format) and Argon2, with WordPress automatically selecting the strongest available algorithm based on PHP version and server capabilities. Check your WordPress version and PHP version to determine which algorithm your installation uses.

Yes, paste an existing WordPress $2y$ bcrypt hash into the Verify section along with the original password to test if they match. The tool performs the same verification logic that WordPress uses for password authentication, making it useful for testing, debugging authentication issues, or verifying password correctness without accessing WordPress databases directly.

For bcrypt ($2y$) hashes, no custom salt is needed—bcrypt automatically generates and embeds a unique random salt in each hash. For PHPass ($P$) hashes, an 8-character salt is required and should be randomly generated. Use the auto-generate salt feature for PHPass hashes, or provide your own 8-character salt if you need deterministic hashing for specific testing scenarios.

Treat WordPress password hashes as sensitive data—never share them publicly or expose them in unsecured locations. While hashes cannot be directly reversed to passwords, they can be cracked with sufficient computational resources. Protect exported CSV files or hash databases with encryption, access controls, and secure storage practices. Hash databases are valuable targets for attackers attempting password cracking.

No, this tool runs entirely offline in your browser and does not connect to or modify your WordPress installation. It generates hashes locally that you can then manually import into WordPress databases if needed. The tool never accesses your WordPress site, database, or server—all processing happens locally for complete privacy and security, making it safe for testing without affecting production WordPress installations.

PHPass ($P$) is the legacy hash format used in older WordPress versions, using a portable hash algorithm with 8-character salts. Bcrypt ($2y$) is the modern format used in WordPress 5.0+, providing stronger security through adaptive cost factors and automatic salt generation. Bcrypt is cryptographically stronger and recommended for new installations, though WordPress maintains backward compatibility with PHPass for existing users.

Yes, WordPress automatically rehashes passwords from PHPass to bcrypt when users log in on modern WordPress installations. You can also use this tool to generate bcrypt hashes for migration scripts, but the recommended approach is letting WordPress handle rehashing automatically during login, as this ensures proper integration with WordPress authentication systems and maintains user experience without forced password resets.

Export hashes as CSV from the batch processing feature, then import them into the wp_users table using WordPress database tools, SQL imports, or migration scripts. Ensure hash format matches your WordPress version expectations (PHPass for older versions, bcrypt for newer versions), and verify hash length fits within database column constraints. Always backup your WordPress database before importing hash data.

PHPass ($P$) works on all PHP versions WordPress supports. Bcrypt ($2y$) requires PHP 5.5+ but is fully utilized in PHP 7.2+. Argon2 requires PHP 7.2+ and is used automatically when available. Modern WordPress installations (5.0+) prefer bcrypt or Argon2 when PHP supports them, falling back to PHPass only on older PHP versions for backward compatibility.

Yes, generate a new hash for your desired admin password, then update the wp_users table directly in the WordPress database to replace the old hash. However, this requires database access and should be done carefully. Alternatively, use WordPress password reset functionality or wp-cli commands for safer password reset workflows that integrate properly with WordPress security features.

Hash compatibility depends on WordPress and PHP versions. PHPass ($P$) hashes work with all WordPress versions. Bcrypt ($2y$) hashes require WordPress 5.0+ with PHP 7.2+. Always verify hash format compatibility with your target WordPress installation before deploying, as using incompatible hash formats will cause authentication failures even with correct passwords.

PHPass ($P$) hashes are 34 characters starting with $P$ followed by a single character cost indicator, 8-character salt, and 22-character hash. Bcrypt ($2y$) hashes are 60 characters starting with $2y$ followed by cost factor, 22-character salt, and 31-character hash. Both formats are base64-encoded and include all necessary information (algorithm, cost, salt, hash) in the hash string itself.