Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm unable to login to my wordpress site v3.1.3 even though I know the password.

To be extra sure, I directly changed the password for the user account (ID=1) with

UPDATE wp_users SET user_pass="(MD5-hash-of-pwd)" WHERE ID = 1;

I've verified that:

  1. ID=1 is my user account
  2. Triple checked that the MD5 hash is correct for the password I am setting it for
  3. Quadrupled checked that my user_login name is the one I'm using

I then go to my wordpress login and am told that my username and password is incorrect.

I also tried using the "forgot password" flow that allows me to reset by email. I succesfully changed the password using that flow but still can't login. Oddly enough, I noticed that when I look directly in MySQL, the hash value for is different when I generate it with and online MD5 tool vs. the password reset flow.

I've verified on the wordpress site that they state they use MD5 for pwd hashes: http://codex.wordpress.org/Resetting_Your_Password

What's going on?!

share|improve this question

migrated from stackoverflow.com Jul 2 '11 at 5:10

This question came from our site for professional and enthusiast programmers.

    
What version of wordpress? –  Kerry Jul 1 '11 at 18:37
    
@Kerry: It's version 3.1.3 –  TMC Jul 1 '11 at 18:50
    
IF the values are different than what you expect them to be, maybe Wordpress is using something other than md5 for the password hashing. –  YonoRan Jul 1 '11 at 18:54
    
@ YonoRan -- WordPress used to publicly say it used the md5 hash. –  Kerry Jul 1 '11 at 19:12
    
Wordpress help topic indicates they use MD5 still: codex.wordpress.org/Resetting_Your_Password. Regardless, I'm still confused why the pwd reset by email flow doesn't result in my being able to sign in with the new pwd I set. –  TMC Jul 1 '11 at 19:28

1 Answer 1

WordPress does NOT use the MD5 hash for passwords anymore. It uses the PHPass library to generate secure password hashes.

However, WordPress will support MD5 hashed passwords. On the first login of a user with such a password, it will detect that case and change the password entry to be the newer, more secure, PHPass version of the password.

Therefore, the codex is not wrong. Putting an MD5 password into the DB will work and let you login, due to this backwards compatibility.

That said, the password reset by email, if you get the password, can't be mistaken. Perhaps something is wrong with your database itself or you're having caching issues. Try repairing the database tables using phpMyAdmin or similar.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.