Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I am trying to check the passwords of users I created on my WP multisite, but the ones I find in the sw_users / user_pass do not match what I get when I do a MD5 hash of the passwords I received during the user signup process.

Here is an example from the table sw_users:

(11, 'user5', '$P$BiwskWiaqZIQLzDUTAhSyvACr0Jpnl.', 'user5', 'user5@domain.com', '', '2012-03-28 11:44:08', '', 0, 'user5', 0, 0),

so I would assume that

$P$BiwskWiaqZIQLzDUTAhSyvACr0Jpnl.

is the result of MD5 hash of the password. Is this correct? And why can I not match this when I run MD5 to the given password which is either

EJnltoRrQC6K

or

fnxIwBW9Sjrm

share|improve this question
add comment

1 Answer 1

up vote 2 down vote accepted

Wordpress does not just MD5 hash the password, it runs it through wp_hash_password() which in turn runs through the $wp_hasher (a global object) HashPassword method. This does some hsld crap to include getting random bytes of data, salting the password, and encrypting it. Basically it's doing a whole lot more than an md5 to make it VERY difficult to reverse, even if you have the hashed password.

share|improve this answer
    
In the documentation of wp_hash_password is also an example how to do what tucson tries to archieve. –  tim Mar 29 '12 at 11:23
    
Thank you m0r7if3r. That explains. –  tucson Mar 29 '12 at 11:28
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.