WordPress Password Hash Generator & Checker

WordPress stores password hashes in the user_pass column of the wp_users table. Since WordPress 6.8 (April 2025) new hashes start with $wp$2y$ — bcrypt over an HMAC-SHA384 of the password — while older sites still hold phpass hashes starting with $P$B. This tool creates either format for resetting a password straight in the database, writes the matching SQL UPDATE, and checks a password against any WordPress hash, all in your browser.

How to use this tool

1. Choose create or check, and enter the password.
2. To create, pick the 6.8+ bcrypt format (or phpass for very old installs) and the cost.
3. Enter the user login and table prefix to get the SQL statement.
4. To check, paste the user_pass value from the database.

Formula

WordPress 6.8+: "$wp" + bcrypt( base64( HMAC-SHA384( trim(password), key "wp-sha384" ) ) ) phpass: "$P$B" + salt + encode64( MD5ⁿ(salt ‖ password) ), n = 2¹³

The HMAC step turns any password into 64 Base64 characters, so nothing is lost to bcrypt’s 72-byte limit; the "$wp" prefix tells WordPress to apply it when checking. bcrypt’s cost 10 means 2¹⁰ rounds; PHP 8.4 raised its default to 12. phpass iterates MD5 8,192 times and uses its own Base64 alphabet (./0-9A-Za-z).

Example

Checking the password password against $wp$2y$10$RH3MLkbCSpemAYuNpxSlJu/8/zR5… gives Match; "Password" with a capital P gives No match. The phpass test hash $P$9IQRaTwmfeRo7ud9Fh4E2PdI0S3r.L0 matches the password test12345.