WordPress Password Hash generator

Our free online WordPress Password Hash Generator converts plain-text passwords into WordPress-compatible hashes using bcrypt, phpass, or MD5. It is particularly useful when you need to reset a WordPress password directly in the database or generate a password hash for a specific WordPress version.

How to Use the Tool

1. Select the WordPress Version. At the top of the generator, choose the version your website uses: 6.8 or newer, 4.4–6.7, 2.5–4.3, or 0.71–2.4 (MD5). The selected option determines which password hashing algorithm will be used.
2. Enter your password. Type or paste the plain-text password into the Password input field on the left. This is the original password that will be converted into a hash.
3. Click Generate Hash. Press the blue Generate Hash button below the password field. The tool processes your password using the selected WordPress hashing algorithm and generates a compatible hash.
4. Copy the generated hash. The result appears in the Hash field on the right. Click the blue Copy button below it to copy the complete hash to your clipboard.
5. Clear the fields. To start over, click the red Clear button. This removes the entered password and generated hash.

Using the generated hash: You can insert the copied value into the user_pass column of your WordPress wp_users database table using phpMyAdmin or another database management tool. Make sure to select the correct user record and use the actual table prefix configured for your installation.

Password hashing is a one-way operation. The generated hash cannot be directly converted back into the original password. For current WordPress installations, use the 6.8 or newer option to generate a modern bcrypt-based hash.

WordPress 6.8 and Newer: Modern bcrypt + HMAC-SHA-384

Starting with WordPress 6.8, core replaced phpass with bcrypt combined with HMAC-SHA-384 pre-hashing. This pipeline bypasses standard bcrypt’s 72-byte limit and strengthens resistance against attacks.

How wp_hash_password() Works

• trim() strips leading and trailing spaces.
• hash_hmac('sha384', ...) generates a 384-bit HMAC using the fixed wp-sha384 key.
• base64_encode() converts the binary output into a 64-character string.
• password_hash() applies bcrypt with a random salt and appends the $wp prefix.

$password = 'ExamplePassword123!';

$prehashed = base64_encode(
    hash_hmac('sha384', trim($password), 'wp-sha384', true)
);

$hash = '$wp' . password_hash($prehashed, PASSWORD_BCRYPT);
echo $hash;

Database format: WordPress 6.8+ hashes start with $wp$2y$ (e.g., $wp$2y$12$...) and are 63 characters long. Standard online bcrypt hashes will fail here because they lack the wp-sha384 preprocessing and $wp prefix.

WordPress 2.5–6.7: The Classic phpass ($P$B) Format

For nearly two decades, WordPress used the phpass framework. Our tool splits this into two ranges (2.5–4.3 and 4.4–6.7) because WordPress 4.4 introduced a strict 4,096-byte input limit to prevent DoS attacks. Both ranges generate the exact same portable hash structure.

$hasher = new PasswordHash(8, true);
$hash = $hasher->HashPassword(trim($password));

Hash format: Always 34 characters long, beginning with $P$B. The character B indicates an iteration exponent of 2^13 (8,192 MD5 loops), followed by an 8-character random salt and a 22-character hash payload.

WordPress 0.71–2.4: Legacy MD5 Passwords

Early WordPress versions stored passwords as raw, unsalted MD5 hashes using simple PHP execution:

$hash = md5($password);

Hash format: Exactly 32 hexadecimal characters (0–9, a–f). While insecure by modern standards, pasting a 32-char MD5 hash into wp_users still works: WordPress will authenticate it on login and automatically upgrade it to a modern $wp$2y$ bcrypt hash on the fly.