How can I change the default wordpress password hashing system to something custom?

Question

Can I change the default wordpress password hashing system by overriding the wp_hash_password function from plugin?

If yes, then what will happen to old stored passwords in DB? How will they be validated for login?

Answer 1

Just figured it out. So thought to leave the solution here, if someone else need it:

To change the default hashing system, need to overwrite wp_hash_password() function: (can be done in a plugin)

if ( !function_exists('wp_hash_password') ){
    function wp_hash_password($password) {
                //apply your own hashing structure here
            return $password;
    }
}

Now you will need to overwrite wp_check_password() to match your hashing structure: (can be done in a plugin as well)

if ( !function_exists('wp_check_password') ){
    function wp_check_password($password, $hash, $user_id = '') {
            //check for your hash match
            return apply_filters('check_password', $check, $password, $hash, $user_id);
            }
}

Please check wp_check_password

Answer 2

This worked for me too. Thanks for updating your post. My wordpress is now using SHA1 algorithm. But when I try to login I get the message "Error: Cookies are blocked due to unexpected output." I tried to find the error but wasn't successful. Maybe it's because of line 681 in wp-includes/pluggable.php:

$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
            $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );

            if ( ! hash_equals( $hash, $hmac ) ) {
                    /**
                     * Fires if a bad authentication cookie hash is encountered.
                     *
                     * @since 2.7.0
                     *
                     * @param string[] $cookie_elements An array of data for the authentication cookie.
                     */
                    do_action( 'auth_cookie_bad_hash', $cookie_elements );
                    return false;
            }

Have you encountered something similar or have you any other idea?