I am trying to check the passwords of users I created on my WP multisite, but the ones I find in the sw_users / user_pass do not match what I get when I do a MD5 hash of the passwords I received during the user signup process.

Here is an example from the table sw_users:

(11, 'user5', '$P$BiwskWiaqZIQLzDUTAhSyvACr0Jpnl.', 'user5', 'user5@domain.com', '', '2012-03-28 11:44:08', '', 0, 'user5', 0, 0),

so I would assume that


is the result of MD5 hash of the password. Is this correct? And why can I not match this when I run MD5 to the given password which is either





Wordpress does not just MD5 hash the password, it runs it through wp_hash_password() which in turn runs through the $wp_hasher (a global object) HashPassword method. This does some hsld crap to include getting random bytes of data, salting the password, and encrypting it. Basically it's doing a whole lot more than an md5 to make it VERY difficult to reverse, even if you have the hashed password.

|improve this answer|||||
  • In the documentation of wp_hash_password is also an example how to do what tucson tries to archieve. – tim Mar 29 '12 at 11:23

Wordpress uses phpass password encryption method. it is basically a one-way hashing algorithm.

If you forgot the admin username you can manually override it using phpmyadmin.

all you need to do is follow this step.

  1. Generate Phpass hash using your password. check this url http://scriptserver.mainframe8.com/wordpress_password_hasher.php
  2. Go to the relevant table in the database and change the hashes the one you generated
|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.