WordPress Password Hash Generator

A WordPress password hash generator converts a plaintext password into the hashed format WordPress stores. WordPress never keeps passwords in plain text, so a raw password pasted into the database will not work. This tool produces a valid hash that passes the wp_check_password() function.

The generator matters most when you are locked out and email recovery is unavailable. You create the hash here, then paste it into the user_pass column with phpMyAdmin or WP-CLI. This wp password hash generator supports every WordPress version, including the bcrypt change introduced in 6.8.

Using this WordPress password hash generator takes under a minute and needs no plugin. You only need database access through phpMyAdmin, Adminer, or WP-CLI. Follow the steps below to reset a password directly.

The next login with your chosen password will succeed immediately. WordPress also upgrades the stored hash automatically on that first successful login. Only run this process on sites you own or administer.

WordPress 6.8 changed how passwords are hashed for the first time in years. The old phpass portable system was replaced with bcrypt, a far stronger algorithm. This hardens every account against brute-force attacks by making each hash expensive to crack.

The new default hash carries a $wp$2y$ prefix, which signals a special construction. WordPress pre-hashes the password with SHA-384 before applying bcrypt, because bcrypt ignores anything past 72 bytes. That extra $wp marker distinguishes these hashes from plain bcrypt hashes created by plugins. This WordPress password hash generator produces the correct $wp$2y$ output for 6.8 and later.

Millions of sites still run WordPress versions older than 6.8. Those installs expect a phpass portable hash, which always starts with a $P$ prefix. A hash such as $P$HDXCHroge2B4dB55GPnGI0OytnTvap/ is a typical phpass example.

The phpass format uses many rounds of salted MD5, which was reasonable for its era. It is weaker than bcrypt but remains valid on any pre-6.8 site. This WordPress hash generator still produces $P$ hashes for those older installs. WordPress will silently upgrade a phpass hash to bcrypt the next time that user logs in on 6.8.

Choosing the right format depends entirely on your WordPress version. Using the wrong one will not break the site, because WordPress accepts several legacy formats. Matching the version simply keeps the stored hash at full strength from the start.

The table below maps each WordPress version to its expected hash format. Check your version in the admin footer or the wp-includes/version.php file. When in doubt, a phpass $P$ hash works everywhere, since every modern version can still validate it.

Resetting through the database is the standard recovery method when admin access is gone. First, generate the hash for your new password with this tool. Keep that hash on your clipboard for the next step.

Open phpMyAdmin from your hosting panel and select your site's database. Find the wp_users table, locate your user row, and edit the user_pass field. Replace its contents with your generated hash and save the row. Log in with the new password, and WordPress takes over from there.

Developers with shell access can skip phpMyAdmin entirely. The WP-CLI tool updates a password with a single command and hashes it for you automatically. Running the command below sets the password correctly.

wp user update admin --user_pass=NewPass

WP-CLI applies the right hash format for your WordPress version without manual steps. This wp hash generator is still useful when you lack shell access or want to inspect the raw hash. Both methods reach the same result, so choose whichever fits your environment.

Yes, every hash is generated locally in your browser using JavaScript. Your passwords are never uploaded, logged, or stored on any external server. That makes this tool safe to use even for live production credentials.

Each generation also uses a fresh random salt, so the same password yields a different hash every time. That is expected behaviour and does not affect login, because the salt is embedded in the hash. To create a strong password before hashing it, use our Password Generator. For plain bcrypt hashes outside WordPress, the Bcrypt Generator & Verifier is the right tool.