As you know, Wordpress db has a wp_users table where there is a user_pass field.

Is it possible that two or more different users have exactly the same user_pass value in that field?

  • 1
    user_pass is not a unique column, so technically the same value could be in there twice, but whatever hashing is done seems to involve some randomness or incorporates the current time, because I added a couple of users with the same password but the password hash was different. – Jacob Peattie Nov 29 '17 at 8:44
  • That's exactly what I did before posting :-) – 3000 Nov 29 '17 at 8:44

Theoretically No! But practically Yes!

Every new framework/CMS now implements some sort of library that adds randomness to the actual password. Its a randomly generated salt in form of a random string or time, etc. That is saved along with the hash password in database.

Since theoretically, a collision can occur in any cryptographic function so User passwords may not be considered unique. But practically we know that even for a simple md5 hash algorithm we need to hash about 2^64 values to get a single collision on average.

So practically its impossible to ever see two users with same password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.