I want to keep a check if the user has a particular password, so I have been trying it with wp_check_password but the account for which it is checked gets logged out and can't login again till there is a call of wp_check_password in the code.

Digging into the code, I found out that it sets the password by using the new hash. and moreover if I am using wp_check_password( 'hello', md5('hello'), 1 );, it doesn't even check what is inside the database and returns true. Isn't that a bug?

Any ideas how can I check the user's password?


Your example works correctly. You are checking if password hello matches hashed hello - which it naturally does.

Hadn't thought it through. Your example causes following issue:

  1. You check if hello matches md5 of hello (instead of hash from user's profile).
  2. It does and then WP thinks this is correct, but outdated md5 hash - that must be updated.
  3. It re-hashes hello and updates user with it, locking him out (since his password is now hello instead of whatever it was before).

See wp_authenticate_username_password() function for extensive example, but basic idea is:

$userdata = get_user_by('login', $username);
$result = wp_check_password($password, $userdata->user_pass, $userdata->ID);
  • But it doesn't match in all circumstances, which is what I assumed the problem was. For one the password hash function is pluggable, so its not necessarily using md5 (actually, I don't think it is by default - the default is phpass). Mar 30 '11 at 20:45
  • @goldenapples it doesn't make sense to override wp_hash_password() and leave wp_check_password(). Hash mismatch simply won't allow anyone to pass the check, no? :)
    – Rarst
    Mar 30 '11 at 20:49
  • Oh, you're right. wp_check_password() will work the way you were using it in your answer. I was referring to his original question, checking 'hello' against the md5 of 'hello', which will fail unless md5 is the algorithm actually being used in wp_hash_password... Mar 30 '11 at 20:55
  • @goldenapples native wp_hash_password() does support md5 for backwards compatibility, it re-hashes such passwords on check. Now that I think about it this is likely the issue in original question...
    – Rarst
    Mar 30 '11 at 21:03
  • Yeah, if the two passwords given match using md5, wp_check_password will reset the user's password using the current hashing function. So in the original question, since the two passwords given matched, it was changing the user's password to "hello"... Mar 30 '11 at 21:05

You can grab their hashed password from the database, and compare it to the entry you want to check using wp_hash_password().

To check if the current user's password matches "hello", try this:

if ( $current_user->user_pass == wp_hash_password( 'hello' ) )
  • if ( wp_hash_password( $xx_new_password ) != $xx_userinfo->user_pass ) works differently than if ( !wp_check_password( $xx_new_password, $xx_userinfo->user_pass , $xx_id ) ) Weird! Thanks for helping!
    – Ashfame
    Mar 30 '11 at 21:10
  • This is incorrect. wp_hash_password() applies (in 2020) a random salt to the password before hashing it, so no two calls to it return the same value.
    – O. Jones
    Oct 22 '20 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.