I've got a few automated scripts that run to notify users of certain updates to the application, etc... and for one in particular, I need to be able to display the users user_login and their password.

How do I show the user their password if it's encrypted?

  • 4
    You cannot show them the password, it's one way encryption. It's by design.
    – t31os
    Apr 24, 2013 at 20:54
  • 1
    This is probably a horrible practice, but you could catch it when users register and save it for your own use later. Apr 24, 2013 at 21:09
  • This question shouldn't have been downvoted just because someone assumes the OP is up to something iffy - that's what it looks like to me happened because it's not that badly written as a question compared to some others .... that's my opinion anyway - but maybe there's something in the meta that I haven't seen Aug 19, 2015 at 23:10

2 Answers 2


Theoretically, this could be achieved by saving a user's password elsewhere, when he or she updates it.

Note that this sort of thing is hardly ever recommendable.
In almost all cases, there is a better architectural approach that renders having to be able to show plain-text passwords unnecessary.

That being said, if you absolutely must do it, this is how it could be done:

funtion wpse_97127_save_passes( $errors, $update, $user )
    if (
        empty( $errors->errors ) &&
        ! empty ( $_POST['pass1'] )
    ) {
        /* if you must save it in reversible form, at least don't save it in plain-text */
        $pass = base64_encode(
        // do something with $pass, i.e. save it somewhere
add_action( 'user_profile_update_errors', 'wpse_97127_save_passes', 0, 3 );

The above can be reversed like so:

$pass_from_db = $wpdb->get_results( /* retrieve encrypted, but reversible pass from db*/ );
$pass = rtrim(

Please do not do this in production environments with user accounts of individual entities without their consent or knowledge. That would not only constitute bad practice, but also be an unethical deed.

I do the above in exactly one case with one specific user role, the capabilities of which are limited , new users of which are always set up by an admin or other higher level role, and the password of which is shared with multiple people in the first place.
And still I do not feel good about it.

  • I found this useful for storing things in encrypted form but reversible. I agree that this is probably a bad idea for passwords though.
    – hazrpg
    Sep 7, 2019 at 14:12

User passwords are stored in the database as what is called a hash. hashes are not reversible even if you know the hash and the mechanism used to create it. The only way to "decrypt" a hash is to take a password, hash it, compare it against the target hash, and try again... over and over until you get a match. If you think about that, you aren't really decrypting at all. It is just brute force trail and error.

The plain text password is never saved and you should not attempt to save it as that undermines the security of the site, and as people tend to reuse passwords the security of a lot of other sites as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.