I am in the process of migrating my site out of Wordpress and I need to filter the registration and/or login process so there is a separate database field that holds the user password in a hash that can be easily used on a non-WP site.

How can I go about this?

  • I'm not sure I understand your question. Passwords are stored in the database already hashed, so where are you accessing the cleartext passwords? – Chip Bennett Feb 27 '12 at 16:57
  • I'm not viewing them in cleartext. I just need new users to have MD5 at least. I figured having two columns for passwords for the Wordpress hash + a column for MD5 that gets updated as people login / new people register. – Kyle Feb 27 '12 at 16:58
  • 1
    I'm sorry; I still don't understand your question. Where do these "two columns" exist? Are you writing some sort of export script or something? – Chip Bennett Feb 27 '12 at 17:02
  • So, are you asking how to take an SHA-hashed password, and convert it into an MD5-hashed password? If so, that question really isn't WordPress related. – Chip Bennett Feb 27 '12 at 17:11
  • The user_pass in the wp_users table is the hashed WP password field. Since I can't just convert those to MD5 or anything, I thought if I created a separate field in the wp_users table called user_pass_md5, I could update that whenever a new person registers, or when a person logs in (so it checks the user_pass value, if they authenticate with it, then store an md5 version of their password in the user_pass_md5). – Kyle Feb 27 '12 at 17:15

It is possible to write code to grab the user's password on login and write it out in a different format to a different location. Over time, you would thus accumulate the passwords in a different format than WordPress itself uses (it makes use of the excellent PHPass library for password storage).

To do this, you'd most likely use the "check_password" filter, which can receive the boolean result of the password check, the plaintext password, the hashed password (using PHPass), and the user ID number.

However, before doing this, you should probably consider a better approach. Storing passwords in a less secure manner such as MD5 isn't really advisable. If you need to authenticate in another web application, just use the existing hashes and the PHPass library to do the authentication against them. It's pretty much as simple as this:

require_once( '/wp-includes/class-phpass.php');
$hasher = new PasswordHash(8, true);
$check = $hasher->CheckPassword($password, $hash);

Because hashing is a one way procedure, to convert to MD5 you have 2 choices:

  • Ask users to reset their passwords when you transition to the new system
  • Bruteforce the existing WordPress hashes. This will likely take many years at great expense.

I advise you opt for the first option. It allows you to let users choose more secure passwords at the same time or enforce stricter/better/longer password rules. Storing both hashes would be a bad idea ( and a potential security issue )

Also I would advise against using MD5 as vanilla MD5 can be bruteforced with relative ease nowadays using rainbow tables. SHA-2 is a better bet, coupled with salts based on the user themselves, e.g. sha_hash_password(username.'_'.password.'_'.common_salt);

  • I'm currently converting a non-WordPress site with forum to a Wordpress driven site, and we chose the first option for managing the user transition. We are pushing the user list into WordPress then running a mass password reset, sending everyone their new randomly generated passwords. This has an added bonus of notifying everyone there is a new site launch, potentially bringing them back to the site/forums. – SickHippie Feb 27 '12 at 19:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.