Skip to content
ThemesIonic — home

WordPress Password Hash Generator

This runs entirely in your browser. Nothing typed here is sent to this site or stored anywhere.

When you need this

You have database access and no way into the dashboard: the password is lost, the reset email never arrives, or the account itself is gone. The repair is a value written straight into the user_pass column of wp_users.

Which hash to use

Since WordPress 6.8 the core stores passwords as bcrypt with a $wp prefix — the $wp$2y$10$… value above. Before hashing, WordPress runs the password through HMAC-SHA384 with the fixed key wp-sha384 and base64-encodes the result, so a password longer than bcrypt's 72-byte limit keeps all of its entropy. The prefix marks that pre-hash. A plain $2y$ hash of the raw password, from any other bcrypt tool, is also accepted on 6.8+, but WordPress converts it to the $wp format at the first login.

Hash Works on After the first login
$wp$2y$… (bcrypt) WordPress 6.8 and newer kept, unless the server's bcrypt cost differs
32-character MD5 every version, 6.8+ included replaced with the current format
$P$… (phpass) every version; written before 6.8 replaced on 6.8+

Not sure which version the site runs? Use MD5. wp_check_password() still treats any hash of 32 characters or fewer as MD5 before it tries anything else, so the value is accepted everywhere, and WordPress re-hashes the password on the first successful login. MD5 is not a safe way to store a password, which is exactly why that value should live for one login only.

If a security plugin replaces WordPress's password hashing, the $wp hash may not match; MD5 is still checked first, so it remains the fallback.

Doing it safely

  1. Back up the database first. A mistyped UPDATE without a WHERE clause rewrites every account.
  2. Scope the statement. Match on user_login or ID, never on nothing.
  3. Use the real table prefix. Many installs are not wp_; the value is in wp-config.php, explained in wp-config.php.
  4. Log in, then change the password through the profile screen, especially if you used the MD5 hash.
  5. Ask why you were locked out. A password that stopped working on its own is a different problem from one you forgot — see how to fix a hacked WordPress site.

If the account does not exist at all

Changing a password will not help when there is no administrator left. That case needs a new row in wp_users and the matching capability rows in wp_usermeta, which is covered step by step in adding a WordPress admin user via phpMyAdmin.

If you would rather not touch the database, resetting the admin password covers the WP-CLI and must-use plugin routes, both of which are less invasive.

About this page

The passphrase and the hash are generated in your browser using its own cryptographic random number generator. Nothing is transmitted to this site, logged, or stored.