WordPress Password Hash Generator

Generate secure WordPress password hashes for database updates or password resets.

Enter a password to check its strength
WordPress Password Hash
This is the hashed password that WordPress would store in the database.
SQL Query for Password Reset
Use this SQL query to update a user's password directly in the WordPress database.
Warning: Always backup your database before making direct changes.
PHP Code
PHP code to generate this hash (for reference).
WordPress Authentication System
How WordPress Stores Passwords

WordPress uses the phpass Portable PHP password hashing framework to securely store passwords. When a user creates or changes their password:

  1. WordPress generates a random salt value
  2. The password is hashed using the salt and multiple iterations of MD5
  3. The resulting hash is stored in the database (in the wp_users table's user_pass column)
WordPress Hash Format

WordPress password hashes follow this format:

$P$BXXXXXXXXXXXXXXXXXXXXXXXXXX

Where:

  • $P$ - Identifier for the phpass format
  • B - A single character representing the iteration count (higher = more secure)
  • XXXX... - The actual hashed password with salt (22 characters)
Security Features
  • One-way Hashing: Passwords cannot be reversed from the hash
  • Unique Salt: Each password has its own unique salt
  • Slow Hashing: Multiple iterations make brute-force attacks impractical
  • Portable: The hash format includes all information needed for verification
Note: Since WordPress 3.7, WordPress has included an option to use the more secure bcrypt algorithm if available on the server.
Common Use Cases
1. Reset a User's Password

If a user has lost access to their WordPress account and the reset email function isn't working, you can manually update their password in the database:

  1. Generate a hash for the new password using this tool
  2. Use the provided SQL query to update the user's password in the database
  3. The user can now log in with the new password
2. Bulk User Creation

When programmatically creating multiple WordPress users, you can pre-generate secure password hashes for each user:

  1. Generate hashes for each user's password
  2. Insert the hashes directly into the wp_users table
  3. This avoids storing plain text passwords in your scripts
3. Development and Testing

During development or when setting up test environments:

  1. Generate consistent password hashes for test accounts
  2. Use these hashes in database fixtures or migrations
  3. Maintain security even in development environments
Important: Always use strong, unique passwords. This tool helps you generate the hash, but the security of the password itself is equally important.
About This Tool

This WordPress Password Hash Generator creates secure password hashes compatible with WordPress's authentication system. It uses the same algorithm that WordPress uses internally.

Features
  • Generates WordPress-compatible password hashes
  • Creates ready-to-use SQL queries for password resets
  • Includes password strength meter
  • Random password generator
  • Secure client-side processing (your password never leaves your browser)
Privacy Note: All processing happens in your browser. Your passwords are never sent to our server.
WordPress Salt Generator

WordPress uses unique authentication keys and salts in the wp-config.php file to enhance security.

Copy these lines to your wp-config.php file to replace the default salts.
What are WordPress salts?
Salts are random strings that WordPress uses to secure cookies and passwords. Changing these values will force all users to log in again.
Related Tools