WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am new to wordpress, I wanted to know where this definition is mentioned in wordpress

return apply_filters('check_password', $check, $password, $hash, $user_id);

I found it in pluggable .php file line no 1470 I wanted to know this because there are two types of password saved one is simple but with encryption and other is with $P$B infront of encrypted password. I wanted to know what is the difference between them and how they are managed.

Please Help. Thanks

share|improve this question

To answer your other question, about the two types of passwords stored in the database:

Up until version 2.5, WordPress stored passwords encrypted with the MD5 hashing algorhythm. MD5 is nowadays considered to be poor security - with moderately-priced off-the-shelf GPUs, it takes less than a hour for a program to brute-force all possible combinations of MD5-encrypted passwords up to 6 characters.

Since version 2.5, WordPress encrypts passwords with phpass, a function based on the SHA1 algorhythm, which is better in terms of security (though still not the most advanced algorhythm out there). The 'check_password' filter exists so that plugins can replace the native SHA1-based password hashing with still more secure algorhythms.

The differing passwords you're seeing are most likely the difference between old users who still have MD5 passwords in the system and newer users with the SHA1 passwords. The SHA password hashes begin with "$P$B". If those users log in to the system with their old passwords, WP will update the stored password hash with one using the current algorhythm.

share|improve this answer
I'd also like to add that its handy that they have kept the MD5 backwards compatibility in there because you can run this SQL query to reset your password if you ever get locked out: UPDATE wp_users SET user_pass = MD5("password") WHERE ID = 'user id' – Brady Nov 17 '11 at 18:00

apply_filters is a generic function that takes the 'check_password' tag and executes all the functions that have attached themselves to it via the add_filter call.

To see which functions are hooking into the 'check_password' filter, use the wordpress hooks database to see all instances here:


edit: for information on what hooks and filters are, see here http://codex.wordpress.org/Plugin_API#Hooks.2C_Actions_and_Filters

share|improve this answer
what is the meaning of hooking into the 'check_password' filter??? – Sparkx Nov 17 '11 at 13:37
apply_filters doesn't do the check_password stuff, you need to read up on hooks and filters, they are a critical component of how Wordpress works. Think of a hook as an event, with functions attached to it, and when the hook is fired, all the functions attached are executed one by one. A filter is a hook where each function is given the value, and then does stuff to it, and passes it to the next function/ – Tom J Nowell Nov 17 '11 at 15:54
Ive ammended the answer with a link to the wordpress codex explaining hooks and filters – Tom J Nowell Nov 17 '11 at 15:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.