2

I'm using WP-Members to let new users register on my site. After they register I check their information and activate them, which emails them a password.

The password that WordPress generates is pretty complicated, e.g. v2Fj4S#b1Df(, but my users are older and I'd like to give them passwords which are a little more memorable, like bucket382potato.

Can I override the native password generator in WordPress to supply my own password scheme?

4
  • @PieterGoosen I don't want users to set their password, I would like to generate it for them. Aug 10, 2014 at 17:24
  • Then you should contact the plugin author Aug 10, 2014 at 17:26
  • 1
    @PieterGoosen This has nothing to do with the plugin, it's using wp_generate_password I assume... Aug 10, 2014 at 17:27
  • Each user can just simply change their password when they login for the first time. No need for them to use the auto generated one. Why risk the security of your site with a predictable password generator Aug 10, 2014 at 17:42

1 Answer 1

3

I figured it out. I created a plugin that adds a filter for random_password, like so:

function my_password_filter($input) {

    $words = explode(' ', "apple arm banana bike bird book chin clam class clover club corn crayon crow crown crowd crib desk dime dirt dress fang field flag flower fog game heat hill home horn hose joke juice kite lake maid mask mice milk mint meal meat moon mother morning name nest nose pear pen pencil plant rain river road rock room rose seed shape shoe shop show sink snail snake snow soda sofa star step stew stove straw string summer swing table tank team tent test toes tree vest water wing winter woman women");

    $num = rand(100, 999);

    return $words[array_rand($words)] . $num . $words[array_rand($words)];

}

add_filter('random_password', 'my_password_filter', 10, 1);
2
  • Congrats. Seems like a good solution. I would think adding some numerals in the mix help against dictionary attacks Aug 10, 2014 at 18:25
  • I agree with @RayMitchell It is a solution, but a very vulnerable one. I still stick with my point that it is every members own duty to change the generated password to something secure and what they can remember Aug 11, 2014 at 6:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.