WordPress Password Hash Generator

When you need this

You have database access and no way into the dashboard: the password is lost, the reset email never arrives, or the account itself is gone. The repair is a value written straight into the user_pass column of wp_users.

Why MD5 is the right answer here, and only here

MD5 is not a safe way to store passwords, and WordPress does not store them that way. What it does is accept an MD5 value as a bootstrap: on the first successful login it recognises the legacy format, verifies it, and immediately re-hashes the password with its current algorithm. The MD5 exists for exactly one login and is then replaced.

That is why this works, and also why the hash should be treated as a temporary credential. Log in once, then change the password from inside WordPress.

Doing it safely

1. Back up the database first. A mistyped UPDATE without a WHERE clause rewrites every account.
2. Scope the statement. Match on user_login or ID, never on nothing.
3. Use the real table prefix. Many installs are not wp_; the value is in wp-config.php, explained in wp-config.php.
4. Log in, then change the password through the profile screen so it is stored with the current algorithm.
5. Ask why you were locked out. A password that stopped working on its own is a different problem from one you forgot — see how to fix a hacked WordPress site.

If the account does not exist at all

Changing a password will not help when there is no administrator left. That case needs a new row in wp_users and the matching capability rows in wp_usermeta, which is covered step by step in adding a WordPress admin user via phpMyAdmin.

If you would rather not touch the database, resetting the admin password covers the WP-CLI and must-use plugin routes, both of which are less invasive.

About this page

The passphrase and the hash are generated in your browser using its own cryptographic random number generator. Nothing is transmitted to this site, logged, or stored.