WordPress password hash generator.

Why it changed

WordPress 6.8 changed how passwords are stored.

Since WordPress 6.8, released in April 2025, core stores passwords with bcrypt instead of the old phpass method. It first runs the password through HMAC-SHA384 with the key wp-sha384 and base64-encodes the result, so long passwords keep their strength despite bcrypt's 72-byte limit, then hashes that with PHP's password_hash and adds a $wp prefix. That's why new hashes in the wp_users table look like $wp$2y$10$… or $wp$2y$12$….

Most password hash generators online still output the old $P$ format. That still works, because WordPress 6.8 and newer accept phpass hashes and quietly upgrade them to bcrypt the next time the user logs in. But if you want the database to hold the same kind of hash WordPress itself writes today, you need a generator that follows the new method. This one does, step for step, and every hash it makes was checked against WordPress core's own verification code before launch.

How to use it

Reset a WordPress password from the database.

1. Type the new password, or use the suggested strong one, and pick your WordPress version. If you're not sure which version the site runs, choose the $P$ format: it works on every version. You can also check the version with the website platform checker.

2. Generate the hash, then set your table prefix (wp_ by default; check $table_prefix in wp-config.php) and the username. The tool writes the matching UPDATE statement.

3. In phpMyAdmin or Adminer, open the site's database, run the SQL, or open the wp_users table, edit the user's row and paste the hash into user_pass. Leave the Function column empty, because the value is already hashed. Then log in with the new password.

If you have command-line access, WP-CLI is quicker and needs no hash at all: wp user update admin --user_pass="your-new-password". And if email works on the site, the normal Lost your password link is still the simplest route.

Check a hash

Test a password against a stored hash.

The Check a hash tab answers a common debugging question: does this password match what's in the database? Paste the password and the user_pass value. The tool recognises the format and checks it the way wp_check_password does: the $wp bcrypt format, phpass, plain bcrypt and old MD5 hashes. It's useful after a migration, when logins fail and you need to know whether the hashes survived the move or a plugin changed how passwords are stored.

Limits

When a new hash won't get you in.

A $wp$ hash only works on WordPress 6.8 or newer, so if you later roll a site back to an older version, those users need a $P$ hash or a password reset. Sites that replace WordPress's login, such as membership plugins, some single sign-on setups and security plugins that override wp_check_password, may store or check passwords differently. If the site was hacked, changing the password isn't enough on its own: check for unknown administrator accounts, update everything, and change the database and hosting passwords too.

The generator never sends the password or the hash to a server; the hashing runs in your browser with your device's secure random generator, and the page's analytics recordings are set to hide this tool. You can load the page, disconnect from the internet, and it still works.

Need a hand?

Locked out after an update or a hack?

If a broken update, a plugin conflict or a hack has locked you out, I fix and maintain WordPress sites: I get you back in, find the cause, clean up and update, and set up the site so it doesn't happen again. Fixed quote after a free review.