Can I change the default wordpress password hashing system by overriding the wp_hash_password function from plugin?

If yes, then what will happen to old stored passwords in DB? How will they be validated for login?

2 Answers 2


Just figured it out. So thought to leave the solution here, if someone else need it:

To change the default hashing system, need to overwrite wp_hash_password() function: (can be done in a plugin)

if ( !function_exists('wp_hash_password') ){
    function wp_hash_password($password) {
                //apply your own hashing structure here
            return $password;

Now you will need to overwrite wp_check_password() to match your hashing structure: (can be done in a plugin as well)

if ( !function_exists('wp_check_password') ){
    function wp_check_password($password, $hash, $user_id = '') {
            //check for your hash match
            return apply_filters('check_password', $check, $password, $hash, $user_id);

Please check wp_check_password


This worked for me too. Thanks for updating your post. My wordpress is now using SHA1 algorithm. But when I try to login I get the message "Error: Cookies are blocked due to unexpected output." Error I tried to find the error but wasn't successful. Maybe it's because of line 681 in wp-includes/pluggable.php:

$algo = function_exists( 'hash' ) ? 'sha256' : 'sha1';
            $hash = hash_hmac( $algo, $username . '|' . $expiration . '|' . $token, $key );

            if ( ! hash_equals( $hash, $hmac ) ) {
                     * Fires if a bad authentication cookie hash is encountered.
                     * @since 2.7.0
                     * @param string[] $cookie_elements An array of data for the authentication cookie.
                    do_action( 'auth_cookie_bad_hash', $cookie_elements );
                    return false;

Have you encountered something similar or have you any other idea?

  • It means you have an echo in your new code, either deliberately or accidentally outside PHP tags, that's triggering sending of the HTML response headers before the cookie has been added. You can use headers_sent to track down where this came from if you can't find it easily yourself.
    – Rup
    Feb 25, 2021 at 0:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.