We are managing the sales, subscriptions and customer profiles/accounts to our products via WP 4.1. The subscriptions are to products on a separate server with .NET. After a customer makes a purchase on the WP side, we'd like to push the customer account details (i.e. user name, password, etc.) to the .NET application and these credentials will be used to log into the .NET app. The challenge that I'm running into is how to duplicate on the .NET side the same hash method used in WP. I know that WP uses PHPass (http://www.openwall.com/phpass/) to hash the passwords, but there isn't a library available for .NET.

A couple of questions:

  1. Is there an "easy" solution to this, to being able to duplicate the hash method on the .NET side?

  2. Is SECURE_AUTH_SALT the salt used for generating the password hash? We have SSL enabled.

One possible solution could be to "degrade" the hash method on the WP side to just a simple MD5 hash using a salt, a method I could then easily duplicate on the .NET side and accomplished as described here How can I change the default wordpress password hashing system to something custom? Thoughts on this?

  • 1
    What about this .NET implementation? – Andrew Bartel Jan 23 '15 at 19:18
  • @AndrewBartel as an answer please, with some context on what it does :) – Rarst Jan 23 '15 at 22:32
  • Thank you for the reference Andrew. This reference to the .NET implementation of PHPass seems to have been for phpBB and not WordPress. The C# implementation of PHPass for WordPress required some minor changes: pastebin.com/wYYTkcPf If anyone needs a C# implementation of PHPass as used by WordPress, as of version 4.1, start with the Andrew's reference (istacee.wordpress.com/2011/08/17/implementation-c-de-phpass) to understand the overall solution, but use the class found here pastebin.com/wYYTkcPf – Pablo Oliva Jan 24 '15 at 15:19
  • Ah, beat me to it @pdaddy. Do you want to put that as an answer with why the changes to the hashGensaltPrivate() method were necessary? – Andrew Bartel Jan 24 '15 at 20:00

Here is the library: http://www.zer7.com/software/cryptsharp

And this is "howtouse":

    public override bool ValidateUser(string name, string password)
        if (string.IsNullOrWhiteSpace(name))
            return false;
        if (string.IsNullOrWhiteSpace(password))
            return false;

        // this is just fetching the hash from the WP-database using BLToolkit. You can use any other way to get the hash from db ;)
        UserData ud = null;
        using (Db db = new Db())
            db.SetCommand(@"SELECT id, user_pass FROM wp_users WHERE user_login=@user_login AND user_status=0",
                db.Parameter("user_login", name)

            ud = db.ExecuteObject<UserData>();


        if (null == ud)
            return false;
        // !!!! HERE IS CHECKING !!!
        // LIB USAGE:
        return CryptSharp.PhpassCrypter.CheckPassword(password, ud.user_pass);

This code is a part of custom MembershipProvider.


I have been also in similar condition as OP and I have been using solution in the reference provided by @AndrewBartel. This solution is targeted at phpBB.

I am explaining the format for the hashed password (Taken from here):

An example hash (of password) is $P$8ohUJ.1sdFw09/bMaAQPTGDNi2BIUt1. A phpass portable hash string has the format $P$RoundsSaltChecksum, where:

  • $P$ is the prefix used to identify phpass hashes, following the Modular Crypt Format. rounds is a single character encoding a 6-bit integer representing the number of rounds used. This is logarithmic, the real number of rounds is 2^rounds. (in the example, rounds is encoded as 8, or 2**13 iterations).

  • salt is eight characters drawn from [./0-9A-Za-z], providing a 48-bit salt (ohUJ.1sd in the example).

  • checksum is 22 characters drawn from the same set, encoding the 128-bit checksum (Fw09/bMaAQPTGDNi2BIUt1 in the example).

As mentioned in the note sections:

Note that phpBB3 databases uses the alternate prefix $H$, both prefixes are recognized by this implementation, and the checksums are the same.

So, the prefix doesn't affect the checksum of the hash. The changes made by @pdaddy are only changing the prefixes to match the prefix used by Wordpress (same as used in PhPass). Just a point to note here is Wordpress also supports both of the prefixes as can be seen in the code here. So, if you want to support both phpBB and Wordpress prefixes, you can change the third line in hashCryptPrivate function as

if ((!genSalt.StartsWith("$P$")) && (!genSalt.StartsWith("$H$"))) return output;

Now, the phpbbCheckHash function should be able to match passwords from both Wordpress and phpBB hashes.


For VB.Net users, simply converting the CSharp code to VB with a converter won't work. I believe it has something to do with the difference in the way the RightShift >> operators work in CSharp compared to VB but I'm not 100% on that. I just know it doesn't work. So..... What I did was create a CSharp class library that I reference in my VB project.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.