bcrypt with pre-hash HMAC-SHA384. WordPress format 6.8 and later. Prefix "$wp$2y$".
WordPress passwords cannot be "decrypted": the algorithm is one-way. To check whether a password matches a hash, use the "Verify" mode.
Rounds of bcrypt (4-15). WordPress uses 10 by default.
How it works
This tool generates and verifies password hashes in the same format WordPress uses, useful for migrating users, repairing logins, or inserting a password directly into the database.
It supports two formats: bcrypt with an HMAC-SHA384 pre-hash (WordPress 6.8 and later, $wp$2y$ prefix) and phpass based on iterated MD5 (earlier versions, $P$ prefix). In Verify mode it detects the format automatically.
The cost controls how many rounds are applied: the higher the cost, the slower the hash is to compute and the more resistant to brute force. WordPress uses 10 for bcrypt and 8 for phpass by default.
Examples
bcrypt (WP 6.8+)$wp$2y$10$… → the $wp$ prefix prepended to a standard 60-character bcrypt.phpass (WP < 6.8)$P$B… → 34 characters in total, with an 8-character salt.Each hash includes a random salt, so the same password produces different hashes each time.VerifyPassword + stored hash → matches / does not match.Use cases
- Reset a user's password by directly editing the user_pass field in the wp_users table.
- Migrate accounts to or from WordPress while keeping existing passwords.
- Check whether a password matches a hash exported from the database.
- Generate test hashes to develop or debug a site's authentication.
Frequently asked questions
What format does WordPress use for passwords?
Since version 6.8 it uses bcrypt with an HMAC-SHA384 pre-hash ($wp$2y$ prefix). Earlier versions use phpass, a portable scheme based on iterated MD5 ($P$ prefix). Both include a salt.
Why did WordPress 6.8 switch to bcrypt?
phpass (iterated MD5) became outdated against current attacks; bcrypt is much more resistant. The SHA-384 pre-hash also avoids the 72-byte limit that bcrypt has on the password.
Can I paste the hash directly into the database?
Yes. Copy the generated hash into the user_pass field of the wp_users table; WordPress recognizes both the bcrypt and phpass formats when logging in.
What is the cost and what value should I use?
It is the work factor, that is, how many rounds are computed. A higher value is more secure but slower. The default values (10 for bcrypt, 8 for phpass) offer a good balance.
Does the same password always generate the same hash?
No. Each hash includes a random salt, so the same password produces different hashes. That is why, to check a password, you use Verify mode instead of comparing hashes with each other.
Is my password sent to a server?
No. All hash computation and verification happen locally in your browser; the password never leaves your device.