WordPress Password Hash Generator

Version Support and Examples

This tool is for the `wp_users.user_pass` field in WordPress 6.8 and later. Legacy phpass hashes usually start with `$P$`; the new default user password hashes usually start with `$wp$2y$`. The examples below show both formats.

Legacy Example (common phpass before 6.8)

$P$Bxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Modern Example (default user password from 6.8)

$wp$2y$12$example-hash-body

What Changed in WordPress 6.8

Starting in WordPress 6.8, `wp_hash_password()` no longer creates phpass portable hashes by default. It HMAC-SHA-384 pre-hashes the password with `wp-sha384`, base64 encodes that digest, then passes it to bcrypt. `wp_check_password()` still accepts old `$P$` hashes and some legacy MD5 hashes; after login or password change, old hashes are opportunistically upgraded.

Source and Limits

The basis is the WordPress Core 6.8 dev note and the current `wp_hash_password()` source. This is not for post passwords, WordPress 6.7-and-earlier-only sites, or installations that changed `wp_hash_password_algorithm` to Argon2 or another algorithm. The bcrypt cost is embedded in the hash and WordPress can verify it; if your site default differs, WordPress may later mark it as needing rehash.