Locked out of wp-admin with a dead email address? The WordPress hash generator turns any password you choose into the exact string WordPress keeps in its database, so you can generate WordPress password hash values, paste it into the wp_users table, and log back in. The tool runs in your browser, which means the password you type never has to leave your device.
How a WordPress Password Hash Generator Works
WordPress never stores your password as plain text. When you save a new password, the site passes it through a one-way algorithm and keeps only the result in the user_pass column. At login, WordPress hashes what you typed and compares the two strings. A password hash generator repeats that same step outside WordPress, so you get a valid WordPress password hash without needing a working admin session. The postgres md5 password hash generator is completely free to use, with no rate limits, watermarks, or hidden restrictions.
Inside a normal install, the work is done by the wp_hash_password() function. A hash generator reproduces its output: a fixed-length string that cannot be reversed back into the original password. That is also why hackers who copy your database do not automatically get your passwords, and why strong passwords still matter for every user on the site.
The approach is called password hashing, and what WordPress stores is a true one-way hash: easy to compute from the password, practically impossible to run backwards. The scheme follows the portable phpass framework, written for PHP applications that need the same hash on every server.
Why the same password gives a different hash every time
Each hash begins with a random salt, a short string mixed into the password before hashing. Two users with the identical password therefore end up with different values in the database, and precomputed rainbow table attacks stop working. Generate the same password ten times and you will see ten different strings, and all ten will verify correctly at login.
WordPress Password Hash Formats Compared
Three formats exist in the wild, and choosing the right one is the only real decision when you use a hash generator. The table lists what each format looks like and which WordPress version accepts it. You can generate an sha3 hash in seconds with a free tool that runs entirely in your browser.
| Format | Prefix | Algorithm | Accepted by |
|---|---|---|---|
| Plain MD5 | 32 hex characters | MD5 with no salt | Very old installs; replaced on first login |
| Portable phpass | $P$ | MD5 repeated 8,192 rounds with an 8-character salt | Every release, including 6.8 and later |
| Bcrypt | $wp$2y$10$ | bcrypt over an HMAC-SHA384 pre-hash, with its own salt | WordPress 6.8 and newer only |
Choosing between phpass and bcrypt
If you do not know which version the site runs, pick the portable phpass format. WordPress 6.8 accepts it once and quietly performs a re-hash to bcrypt on the next login, while older installs reject a bcrypt string outright. Choose bcrypt only when you are sure the site is on WordPress 6.8 or newer.
Legacy formats and other CMS platforms
Plain MD5 is a legacy format from WordPress 2.4 and earlier, and a modern site will accept it once and then replace it. Other CMS platforms use their own schemes, so a string that works for a forum or for Joomla will not necessarily log you into WordPress. Always match the hash to the software that will read it.
The formula behind a phpass hash
The portable format starts with the salt and password, then feeds the result back through MD5 thousands of times:
$$h_0 = \text{MD5}(\text{salt} \,\|\, \text{password}), \qquad h_i = \text{MD5}(h_{i-1} \,\|\, \text{password}), \quad i = 1 \ldots 8192$$
The final \(h_{8192}\) is encoded in a custom base-64 alphabet and appended after the $P$B prefix and the salt, giving the familiar 34-character result.
How to Reset WordPress Password in the Database
When the password reset email never arrives, editing the database directly is the most dependable way back in. You need access to phpMyAdmin or any other SQL client for the site's database.
- Type the new password into the hash generator and pick the hash format.
- Press the generate hash button and copy the hash output.
- Open phpMyAdmin and find the wp_users table (a multisite install may use a different table prefix).
- Locate the row whose
user_loginmatches your admin account. - Replace the value in the user_pass column with the copied hash and save.
- Log in with the new password; WordPress may re-hash it to its newest format.
Running it as an UPDATE statement
If you prefer an SQL query, a single update statement does the same job:
UPDATE `wp_users` SET `user_pass` = 'YOUR_GENERATED_HASH' WHERE `user_login` = 'YOUR_USERNAME';Swap in your generated hash and the real username. Take a copy of the old row first, because the previous hash is the only record of the old password and a direct database change has no undo.
Worked Example: Generating a WordPress Hash for a Locked-Out Admin
Say the administrator mara.ellison wants the new password Cedar!Lantern#2931, and the site is on an unknown release. Choosing portable phpass with the salt Zk7pQ2xM and the 8,192 rounds from the formula above produces this WordPress password hash:
$P$BZk7pQ2xMWd4xtdNRn1jrj69W9O//60
Read it from left to right: $P$ marks phpass, B encodes 213 = 8,192 rounds, Zk7pQ2xM is the 8-character salt, and the last 22 characters are the encoded digest, 34 characters in total. The matching statement is UPDATE wp_users SET user_pass = '$P$BZk7pQ2xMWd4xtdNRn1jrj69W9O//60' WHERE user_login = 'mara.ellison'; and one row is changed.
Generating a Password Hash for a WordPress 6.7.2 Admin
Tomasz Wieczorek inherits a client's staging site on a Friday afternoon. The previous developer left, the admin address [email protected] bounces, and the only thing he can reach is phpMyAdmin. Before generating anything he opens wp-includes/version.php through the file manager: 6.7.2. That matters, because bcrypt hashes arrived with WordPress 6.8, so a $wp$2y$ string would be rejected on this install.
He types the new password Quarry-Fennel-7305 (18 characters) into the generator, selects the portable phpass format, and gets $P$BHn3vR8LcdIex/BgPA.SJ620afvSgB., which is 34 characters and starts with $P$B, exactly the shape a 6.7.x site expects. In the wp_users table he finds the row where user_login is dev_owner (ID 1) and, before touching it, exports the row so the old hash survives.
He pastes the new value into user_pass and saves. One row is affected. Logging in with the new password works on the first try, and the dashboard's Users screen shows no prompt to reset again. Because the site is a client's, his next step is specific: he installs the update to 6.8 on staging only, logs in once more to confirm WordPress re-hashes the account to bcrypt on that first login, and then emails the client the temporary password with an instruction to change it from the profile page. The whole recovery takes under ten minutes, and nothing was uploaded anywhere.
When You Need a WordPress Hash Generator
Locked out of WordPress
The classic case: the admin address is a mailbox nobody owns, mail delivery is broken, and the "forgot password" link goes nowhere. A hash gets you in without touching plugins or files.
Database migration and staging
When you import users by SQL script during a migration, you can write hashes directly. The same trick seeds a staging copy with test users whose passwords you know.
Security audit checks
A security audit often asks whether the strings in a dump are valid. Comparing their prefix and length with the table above answers that quickly.
- Locked out: reset an admin when email is unavailable.
- Migration: write hashes into imported rows.
- Development: create test users for QA.
- Verification: confirm a stored hash matches the format you expect.
WP-CLI and Other Safer Alternatives
A direct edit of the database is a last resort, not a routine habit. Whenever you can still reach the dashboard, the built-in profile screen or the lost-password link is safer, because WordPress itself does the hashing and writes the result for you. Reach for a generator when those routes are closed.
If you have shell access, WP-CLI is the cleaner route: wp user update 1 --user_pass="your-new-password" hashes the password for you. To check a hash against a password, run wp_check_password() through wp eval. Use the generator when you can only reach the database, not the server.
Safety Notes for Password Hash Generation
Handle the output like a credential. Prefer a tool that hashes client-side, as this one does, over a server-side service that receives your password. Choose a long, unique password, delete any copies of the hash from chat logs, and change the password again from inside the dashboard once you are back in. Test vectors from the phpass reference implementation are the standard way to confirm that any generator is correct.
Frequently Asked Questions
- What is a WordPress password hash?
- A WordPress password hash is a fixed-length string produced by running your plain-text password through a one-way hashing algorithm (phpass or bcrypt). WordPress never stores actual passwords in its database — it stores the hash. When you log in, WordPress hashes what you type and compares it to the stored hash. Because the process is one-way, the original password cannot be recovered from the hash.
- What hashing algorithm does WordPress use?
- WordPress versions up to 6.7 use the phpass portable hashing framework, which applies iterated MD5 rounds and produces hashes starting with '$P$'. WordPress 6.8 and newer defaults to bcrypt, which is significantly stronger. This tool generates the correct hash format based on the WordPress version you select.
- Why do I get a different hash each time for the same password?
- Both phpass and bcrypt incorporate a random salt each time a hash is generated. This means two hashes of the same password will look completely different, yet WordPress can verify both. This is intentional — it prevents attackers from using pre-computed "rainbow tables" to crack passwords.
- How do I use the generated hash to reset a WordPress password in the database?
- Copy the SQL UPDATE query shown in the results and run it in phpMyAdmin, MySQL Workbench, or any database client connected to your WordPress database. The query updates the user_pass column in the wp_users table for the specified username. After running it, log in to WordPress with the plain-text password you hashed.
- Is my password sent to a server?
- No. All hashing in this tool is performed entirely in your browser using JavaScript. Your password never leaves your device, so there is no risk of it being intercepted or logged on a remote server.
- Which WordPress versions are supported?
- This tool supports WordPress 2.5 and above. Select "2.5 – 4.3" or "4.4 – 6.7" for the classic phpass portable hash, or "6.8 or newer" for the modern bcrypt hash introduced in WordPress 6.8.
- Can I use this to verify an existing hash against a password?
- This tool is a one-way hash generator, not a verifier. Because hashing is one-way, you cannot decode an existing hash. To verify, you would need to generate a new hash for the password and update the database with it — which is exactly the workflow this tool supports.
- When would I need to manually update a WordPress password hash in the database?
- Common scenarios include being locked out of WordPress with no access to the admin email, migrating a site and needing to set known passwords for test users, or scripting bulk user imports. Directly updating the wp_users table with a valid hash is the most reliable method when normal reset flows are unavailable.