CodesBeautify

WordPress Password Hash Generator

Build the salted phpass hash WordPress stores in the user_pass column.

Password
phpass hash
Runs locally in your browser

About the WordPress Password Hash Generator

WordPress has long stored passwords using the portable hash from Solar Designer's phpass library. A stored value looks like $P$B followed by an 8 character salt and 22 more characters, 34 in total. The algorithm is deliberately plain: take the MD5 of the salt joined to the password, then feed that raw 16-byte digest plus the password back into MD5 thousands of times, and finally encode the last digest with the crypt style alphabet ./0-9A-Za-z. The character straight after $P$ records the exponent, so the letter B means 2^13, which is 8192 iterations.

MD5 on its own would be a terrible password store, but the salt and the iteration count are what make this survivable. The salt kills rainbow tables, and eight thousand chained hashes turn a single guess from free into something measurable, which slows a cracking rig by the same factor. It is still far weaker than a memory hard design, and a GPU chews through MD5 at enormous rates, so treat a leaked table of these as compromised.

Use this page to write a known password directly into a database when you have lost admin access, or to seed a test fixture. Leave the salt field blank and a fresh random one is drawn for every run, which is why the output changes each time; type an 8 character salt to reproduce an exact value. Newer WordPress releases hash new passwords with bcrypt and keep verifying old $P$ entries, so a value from here will still log you in and will be upgraded on the next successful sign in. For that newer format see the Bcrypt Hash Generator, and to check an existing hash use Bcrypt Verify.

How to use

  1. Type the password you want to install into the left pane.
  2. Leave Iterations at the WordPress default of 8192 unless you are matching a different phpass configuration.
  3. Enter an 8 character Salt only when you need to reproduce a specific hash; otherwise leave it blank for a random one.
  4. Copy the 34 character value into the user_pass column of the wp_users table.
  5. Tick Show details to see the salt and round count that produced it.

Common questions

Why is the hash different every time I press Generate?
A new random salt is drawn on each run, and the salt is part of the stored string. Any of those values will verify the same password.
Will a $P$ hash still work in current WordPress?
Yes. Recent versions create new hashes with bcrypt but continue to accept phpass ones, and quietly rehash the entry after a successful login.
Can I put this straight into phpMyAdmin?
Yes. Paste the whole string including the $P$ prefix into user_pass for the account. Do not let the editor add spaces or a trailing newline.
Is the password sent anywhere?
No. The MD5 chain runs in your own browser through WebAssembly, and nothing about the password or the resulting hash leaves the page.
Why does the letter after $P$ matter?
It encodes the iteration exponent. B means 2^13 rounds; a different letter tells the verifier to run a different number of passes, so it must be preserved exactly.