2

I'm using WP-Members to let new users register on my site. After they register I check their information and activate them, which emails them a password.

The password that WordPress generates is pretty complicated, e.g. v2Fj4S#b1Df(, but my users are older and I'd like to give them passwords which are a little more memorable, like bucket382potato.

Can I override the native password generator in WordPress to supply my own password scheme?

  • @PieterGoosen I don't want users to set their password, I would like to generate it for them. – a paid nerd Aug 10 '14 at 17:24
  • Then you should contact the plugin author – Pieter Goosen Aug 10 '14 at 17:26
  • 1
    @PieterGoosen This has nothing to do with the plugin, it's using wp_generate_password I assume... – a paid nerd Aug 10 '14 at 17:27
  • Each user can just simply change their password when they login for the first time. No need for them to use the auto generated one. Why risk the security of your site with a predictable password generator – Pieter Goosen Aug 10 '14 at 17:42
2

I figured it out. I created a plugin that adds a filter for random_password, like so:

function my_password_filter($input) {

    $words = explode(' ', "apple arm banana bike bird book chin clam class clover club corn crayon crow crown crowd crib desk dime dirt dress fang field flag flower fog game heat hill home horn hose joke juice kite lake maid mask mice milk mint meal meat moon mother morning name nest nose pear pen pencil plant rain river road rock room rose seed shape shoe shop show sink snail snake snow soda sofa star step stew stove straw string summer swing table tank team tent test toes tree vest water wing winter woman women");

    $num = rand(100, 999);

    return $words[array_rand($words)] . $num . $words[array_rand($words)];

}

add_filter('random_password', 'my_password_filter', 10, 1);
  • Congrats. Seems like a good solution. I would think adding some numerals in the mix help against dictionary attacks – Ray Mitchell Aug 10 '14 at 18:25
  • I agree with @RayMitchell It is a solution, but a very vulnerable one. I still stick with my point that it is every members own duty to change the generated password to something secure and what they can remember – Pieter Goosen Aug 11 '14 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.