WordPress password hash generator
WordPress never stores passwords in plain text; the user_pass column of the wp_users table holds a salted hash. If you are locked out of your own site and cannot use the “Lost your password?” email — for example on a local or staging copy — you can set a new password by writing a freshly generated WordPress password hash into that column. This tool generates hashes in both formats WordPress uses.
Two formats, depending on your version
| WordPress version | Format | Example |
|---|---|---|
| 6.8 and newer | bcrypt with a WordPress prefix | $wp$2y$10$DUIQeb.h09VDd3Qcm2MJ3OKs06yCJCxkADT9YhFagXTvFA/bX1/7C |
| 6.7 and older | phpass “portable” hash | $P$BrWLgFJkWB8Sy7YoS99zH.y0QeLpSO0 |
WordPress 6.8+: $wp$2y$
Since version 6.8 (April 2025), WordPress hashes passwords with bcrypt through PHP’s password_hash(). To avoid bcrypt’s 72-byte limit, the password is first run through HMAC-SHA384 (with a fixed key) and Base64 encoded, and the result is bcrypt-hashed. The $wp prefix marks this pre-hashed format, so it is not interchangeable with a plain $2y$ hash.
WordPress 6.7 and older: $P$
Older versions use the phpass library’s portable hash: an 8-character salt and 8,192 rounds of MD5 (the B after $P$ encodes 2¹³ iterations). It is much weaker than bcrypt, but it is what those versions verify. WordPress 6.8+ still accepts phpass hashes and upgrades them to bcrypt the next time the user logs in, so a phpass hash also works as a fallback on new versions.
Resetting your admin password step by step
- Back up the database first.
- Open the database in phpMyAdmin, Adminer or your host’s database tool and find your user in the wp_users table (the table prefix may differ from wp_).
- Generate a hash here for a strong new password and paste it into user_pass, replacing the old value completely.
- Save, log in with the new password, and remove any temporary access you created.
If you have shell access, WP-CLI is simpler still: wp user update admin --user_pass="new password" hashes the password for you. You can also ask another administrator to send you a reset link.
Use it responsibly
Only change passwords on sites you own or manage with permission. Choose a long, unique password — a password manager or the Password Generator helps — and enable two-factor authentication on administrator accounts. Directly editing user_pass bypasses WordPress’s normal notifications, so tell other administrators what you changed.
The hash is computed locally in your browser; the password is never sent anywhere. To check an existing value, use the WordPress Password Hash Checker; for a standard bcrypt hash for other applications, use the Bcrypt Hash Generator, and for a strong password try the Password Generator.