I have a spreadsheet that was provided to me of users to import to a new site I have built. I was provided with the password in MD5 hash form. I suspect if I insert this into the password field in the database, since it is MD5 it will still match their password when the user tries to login on the new system. Is this a correct assumption?

I also have a large amount of metadata for each user that needs to be inserted.

Because I want to insert the md5 string, and not the password text and the extra custom meta fields, I don't think I can use wp_insert_user.

Does anybody have experience with this type of thing? I am thinking I will just do something directly in mysql, rather than hack up a WP plugin, any suggestions would be appreciated though.


WordPress used MD5 for password hash in the past, but had since moved on to more secure phpass. The good thing is that it retains backwards compatibility - if user had old MD5 hash then it will be checked as such and automatically re-hashed and re-saved using current algorithm, see wp_check_password().

You are correct that you cannot use wp_insert_user() because it expect plain text password.

  • 1
    @rarst: do we have any alternative function that allows inserting users with already hashed password? or any other way of doing it perhaps?
    – Sisir
    Dec 3 '13 at 9:12

I suspect if I insert this into the password field in the database, since it is MD5 it will still match their password when the user tries to login on the new system. Is this a correct assumption?

Check the sourcecode of your wordpress version FIRST to verify that. It might be that this is not the default behavior. So check the source and do a quick hack of your install (put it under GIT , so you have UNDO while editing core (it's fast and you start with git init). This won't kill a single kitten but boost your workflow BTW).

So after you have fixed your login problem (Solution: Add a check against the MD5 hash, if matching, regenerate the password hash with phpass) you can think about the metadata problem.

My answer does not cover it much. I mean, just add the data somehow, it should be trivial. Just add it. If the data is incompatible with your site, you might need to extend your site first, so whatever the deal is, I'm pretty sure you get it managed.

Tip: Insert into the database directly. Just do a MySQL query that does the job. Don't wiggle around too much with wordpress PHP code. Wordpress only knows the MySQL database to store the data. So if you control the data, you control wordpress ;).

  • Thanks, I am planning to go directly into the database for the inserts.
    – benstraw
    Dec 31 '10 at 2:42

I had this problem as well. I ended up solving it by importing MD5 passwords as plaintext, and then changing Wordpress authentication to put the passwords through an MD5 hash before checking them.

My specific approach:

  1. I used a plug-in to import users from a CSV which included their MD5-ed password. This left me with a database full of users unable to login, because their plaintext password was now "5f4dcc3b5aa765d61d8327deb882cf99" instead of "password".

  2. Next, I wrote a plug-in that included tiny changes to wp_hash_password() and wp_check_password() to cause MD5 hashing to be the first step of all password checks. So, when they enter "password", WordPress checks against "5f4dcc3b5aa765d61d8327deb882cf99" instead, and so the authentication check succeeds. I still get the same phpass encryption, the only difference is that I'm never giving it raw plaintext to encrypt.

This was accomplished by copy-and-pasting these functions from pluggable.php into a new plug-in and modifying them to wrap the provided plaintext passwords in md5().

Each function had only one change from the original implementation; this line from function wp_hash_password():

return $wp_hasher->HashPassword( trim( $password ) );


return $wp_hasher->HashPassword(  md5 ( trim( $password ) ) );

and this line from function wp_check_password():

$check = $wp_hasher->CheckPassword($password, $hash);


$check = $wp_hasher->CheckPassword(md5($password), $hash);

With this approach, users get to transparently keep their passwords, and instead of compromising on security, we get to use an ever-so-slightly more secure version of the out-of-the-box authentication scheme.

  • I can't quite make sense of this. Why not just import MD5 hashes and let WP handle the rest, as per my rather old answer here?
    – Rarst
    Jun 21 '14 at 21:30
  • We were using a plug-in that used wp_insert_user().
    – Umopepisdn
    Jun 22 '14 at 2:06
  • I didn't want to muck with the database directly.
    – Umopepisdn
    Jun 22 '14 at 2:07

As Rarst said, If you insert MD5 hash directly into the database for each user, existing md5 password will work.

If someone is looking for db query to update the password for all users, use following code after inserting user.

global $wpdb;

$user_id = wp_insert_user($user_data);

$result = $wpdb->update( 
    array( 'user_pass' => $user_pass ),
    array( 'ID' => $user_id )

@Rarst You are right that you can't use wp_insert_user() in it's original form to insert already hashed passwords, but by changing this line:

$user_pass = wp_hash_password( $userdata['user_pass'] );


$user_pass = $userdata['user_pass']; you'll be able to insert md5 hashed passwords.

By modyfing wp_insert_user() one may use wp_create_user( $username, $password, $email ); to insert new users. Remember to undo your changes in wp_insert_user() when you're done!

  • It's never a good idea to modify WP core, even if you plan to change it back to the original form later.
    – Fayaz
    Mar 17 '17 at 3:06
  • My customer needed to move his users from a non-wp site to a wp-site, and that was the only solution I could come up with since the users' passwords were already hashed. If you have a better solution, please enlighten me
    – Coco
    Mar 18 '17 at 21:51
  • functions such as wp_hash_password, wp_check_password are pluggable functions. What that mean is: if you create a custom plugin and declare your custom function named wp_hash_password, wp_check_password etc. your custom function will override the corresponding WP core function. So that way you may do whatever you want with these password functions without modifying WordPress core.
    – Fayaz
    Mar 18 '17 at 23:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.