Generate WordPress Password Hashes — Free phpass Hash Creator

How to Use This WordPress Database Password Hash Generator Step by Step

Hash Generation for Your Target WordPress Version

Generating a valid hash takes only a few seconds. Follow these steps to update wordpress password and produce a value ready to insert directly into your wordpress database to replace wordpress password hash in the user_pass column: The pin generator shows how many possible combinations exist for your chosen length so you can assess the risk.

1. Enter your password: Type the new plain text password you want to assign, or click the refresh icon to automatically produce a strong random password using the built-in secure password generator.
2. Select your WordPress version: Choose from WordPress 3.x, 4.x, 5.x, 6.x, or 6.8+ to ensure the correct hashing algorithm is applied. Choosing the wrong version produces a hash your site will reject.
3. Generate the hash: Click the Generate Hash button. The tool calls the appropriate algorithm — phpass for legacy versions or bcrypt for WordPress 6.8+ — and returns the hash string instantly.
4. Copy the hash: Use the copy icon or select the hash string manually. This value is your new user_pass for the target user in wp_users.

The internal logic mirrors WordPress's own wp_hash_password() function. For reference, the legacy phpass initialization looks like this:

$wp_hasher = new PasswordHash(8, TRUE);
$password_hashed = '$P$B55D6LjfHDkINU5wF.v2BuuzO0/XPk/';
$plain_password = 'test';

if ($wp_hasher->CheckPassword($plain_password, $password_hashed)) {
    echo "YES, Matched";
} else {
    echo "No, Wrong Password";
}

The PasswordHash constructor accepts a cost factor (here 8) and a portability flag. WordPress uses PasswordHash(8, TRUE) in its phpass implementation, producing the familiar $P$ hashes. The bcrypt path introduced in WordPress 6.8 bypasses PasswordHash entirely and calls PHP's native password_hash($password_to_hash, PASSWORD_BCRYPT, $options) after pre-hashing with SHA-384.

The mathematical cost of bcrypt is controlled by its work factor \(w\). The number of hash iterations is:

At the default cost factor of 10, bcrypt performs 2¹⁰ = 1,024 internal rounds, making each hash attempt take ~100 ms on modern hardware — trivial for a legitimate login, but crippling for an attacker running millions of guesses. This is why cybersecurity professionals recommend bcrypt over faster algorithms for password encryption.

Updating the Password Hash in the WordPress Database

Once you have your hash, you need to write it into the wordpress database. The database modification process requires access to either phpMyAdmin or a MySQL command-line client.

Method 1 — SQL query via phpMyAdmin (recommended):

1. Open phpMyAdmin and select your WordPress database.
2. Click the SQL tab and run the following query, replacing YOUR-HASH with the hash you copied and USER-LOGIN with the exact username:

UPDATE `wp_users` SET `user_pass` = 'YOUR-HASH' WHERE `user_login` = 'USER-LOGIN';

3. Click Go. phpMyAdmin will confirm that 1 row was affected.
4. Log into WordPress with your new password to verify the change worked.

Method 2 — Direct row edit in phpMyAdmin:

1. Navigate to the wp_users table (your table prefix may differ, e.g. mysite_users).
2. Find the row for your user and click Edit.
3. Locate the user_pass field, clear its current value, and paste your new hash.
4. Click Go to save.

Resetting a Lost WordPress Password Using the WordPress Hash Generator

When to Reset a WordPress Password via Database

The standard WordPress password reset flow sends a reset link to the account's registered email address. However, there are scenarios in wordpress user management and database administration where that flow isn't available:

• The admin email address is no longer accessible or was set incorrectly during migration.
• WordPress's mail function is broken or not configured on the server.
• You are setting up a staging or development copy of a site and need to update WordPress password in database without triggering live email notifications.
• You need to change wordpress admin password via hash on a client site without going through the WordPress back-end.

In all these cases, using this wordpress password hash generator no login tool to generate a hash and then applying it via a SQL query is the fastest, most reliable solution to reset wordpress password via database — it requires no plugin, no FTP modification of core files, and no email access — just phpMyAdmin or equivalent MySQL database access. You can also reset wordpress password using hash across any release by selecting the matching version before generating.

Advanced Method — Editing wp-includes/pluggable.php Directly

An alternative sometimes referenced in older tutorials involves temporarily overriding the wp_hash_password() function in wp-includes/pluggable.php to accept a plain text value during a single login cycle. This approach is not recommended for several reasons:

• Any modification to core WordPress files will be overwritten on the next automatic update.
• A mistake in wp-includes/pluggable.php can break authentication site-wide.
• The direct database method using a generated hash achieves the same result with far less risk.

Stick with the generate hash → update user_pass in wp_users workflow for safe, repeatable wordpress site maintenance.

Understanding bcrypt, phpass, and WordPress Password Encryption Methods

Bcrypt was designed by Niels Provos and David Mazières and published in 1999. Its defining feature is an adjustable cost factor that can be increased over time as hardware becomes more powerful, keeping it resistant to brute-force attacks for the foreseeable future. The bcrypt specifications PDF on GitHub and the reference C implementation of bcrypt both confirm that the algorithm's core Blowfish key schedule is what makes it slow — each hash requires running that schedule 2^w times.

For comparison, the phpass wordpress phpass hashing algorithm uses multiple passes of MD5. While MD5 itself is not a password-hashing algorithm (it was designed for speed), phpass adds stretching and salt to make it more suitable for password security. The result is still weaker than bcrypt because MD5 can be computed extremely quickly on modern GPUs, enabling high-speed brute-force attempts even against salted hashes.

bcrypt

Blowfish-based adaptive hashing. Default in WordPress 6.8+. Work factor w = 10 by default (2¹⁰ = 1,024 rounds). Hash format: $wp$2y$10$... in WordPress.

phpass

MD5-based portable PHP hashing. Default in WordPress 3.x–6.7. 256 MD5 passes (\(2^8\)). Hash format: $P$B....

Argon2

Winner of the Password Hashing Competition. Available via PASSWORD_ARGON2ID in PHP. Can be configured in WordPress 6.8+ via the wp_hash_password_algorithm filter, though bcrypt remains the guaranteed-available default.

scrypt

Memory-hard algorithm offering resistance against hardware-accelerated attacks. Referenced in Password Hashing: scrypt, bcrypt and Argon2 comparisons. Not natively available in PHP without an extension.

The WordPress 6.8 implementation is notable for its SHA-384 pre-hashing step. Because bcrypt truncates input at 72 bytes, a password longer than that would have its extra characters silently ignored under naive bcrypt — a vulnerability. WordPress addresses this with:

$password_to_hash = base64_encode(
    hash_hmac('sha384', trim($password), 'wp-sha384', true)
);
return '$wp' . password_hash($password_to_hash, PASSWORD_BCRYPT, $options);

The HMAC with the domain-separation key 'wp-sha384' compresses any-length password into a fixed 64-byte base64 string before bcrypt sees it, preserving full entropy. The $wp prefix distinguishes these hashes from vanilla bcrypt strings, allowing WordPress to identify and re-hash them if the algorithm changes again in a future release. This level of detail is why selecting the correct WordPress version in this wordpress password hash generator all versions tool matters — the hash format is not interchangeable across versions, which is also why this tool lets you target each major release individually using your wp password hash tool.