WordPress Password Hash Generator
Generate a WordPress-compatible phpass ($P$) password hash from a plaintext password, client-side.
How this tool works
Enter a plaintext password
Any password you want hashed for a test/dev user row.
Click "Generate hash"
A random 8-byte salt is generated and the phpass algorithm runs against it.
The hash is self-verified
The same check WordPress would perform confirms the password validates against the output.
Copy into wp_users.user_pass
Paste the resulting $P$-prefixed hash directly into a dev database row.
Quick facts
- Category
- Generators
- Best for
- Manually inserting a test user into a dev database without the full WordPress signup flow
About this tool
Enter a plaintext password and generate a WordPress-compatible hash using the phpass portable hash framework - the same MD5-based, salted, stretched hashing scheme WordPress has historically used to store passwords in the wp_users table's user_pass column, recognizable by its "$P$" prefix. The implementation runs the full algorithm: an 8-byte random salt, a cost factor controlling the iteration count, and repeated MD5 hashing of the salt and password together, all encoded with phpass's own base64-like alphabet rather than standard base64. Each generated hash is immediately self-verified by re-running the same check WordPress's own wp_check_password function would perform, confirming the password actually validates against the hash before it's shown. Be clear about scope: this exists for local development and testing convenience - like manually inserting a test user row directly into a dev database's wp_users table without going through the full WordPress signup flow - and is not a substitute for WordPress's own registration or password-reset process in a production context; newer WordPress versions also default to bcrypt for new passwords, with phpass retained mainly for verifying older legacy hashes. Runs entirely client-side.
Why use this tool
Matches WordPress's legacy format exactly
Implements the real phpass algorithm - salt, cost factor, iterated MD5, custom base64 alphabet - not an approximation.
Self-verifying output
Every hash is checked against the password it was generated from before being shown.
Skips the signup flow for test data
Useful for seeding a dev database without running through WordPress's actual registration process.
Honest about production scope
Clearly labeled for dev/testing convenience, not a replacement for WordPress's real auth flow.
Frequently asked questions
For a WordPress installation still using the phpass format (identified by "$P$"-prefixed hashes in wp_users), yes - this generates a hash using the same algorithm and cost factor WordPress itself uses, and wp_check_password will validate it correctly. Newer WordPress versions (6.8+) default to bcrypt for newly created passwords, though phpass verification is typically still supported for existing legacy hashes, so check which format your specific WordPress version and database actually expect.
A fresh random 8-byte salt is generated on every hash, and the salt is embedded directly in the output string - this is by design, since including a random salt is what prevents identical passwords from producing identical hashes (which would otherwise leak information via a rainbow table or simple comparison). Both hashes will still correctly validate the same password despite looking completely different.
No - this tool is scoped for local development and testing convenience, like quickly seeding a dev database with test users. Production password handling should always go through WordPress's own registration and authentication flow, which includes additional safeguards (proper server-side random salt generation, session handling, and in modern WordPress, bcrypt by default) that a standalone client-side hash generator doesn't attempt to replicate.
Explore more free tools
Formatters, converters, validators, and generators - all free and running entirely in your browser.
Browse more tools