WordPress Password Hash Generator

Locked out of wp-admin and the reset email never arrives? That is usually a mail problem, not a password problem, and it leaves you with one reliable way back in: write a new password hash straight into the database.

You cannot paste a plain password into the user_pass column. WordPress stores a hash, and it has to be a hash WordPress recognises. Type your new password below and this tool returns one, generated by WordPress itself rather than by a copy of the algorithm.

When you actually need this

• The password reset email never arrives because the site cannot send mail.
• You inherited a site from a client or a previous developer and nobody has the admin login.
• A hacked site has had its admin account changed and you are locking it back down.
• You are restoring a database backup onto a staging site and need a login you control.
• You are seeding user accounts in a migration script and need valid hashes up front.

If you can still reach wp-admin, do not use this. Go to Users, edit the account, and set a new password there. This is for when that door is closed.

Reset a WordPress password through the database

Back up the wp_users table before you touch it. Every host’s control panel has an export button, and thirty seconds of exporting beats an afternoon of regret.

1. Generate your hash above. Use the one labelled WordPress 6.8 and newer unless the site is running an older version.
2. Open phpMyAdmin or Adminer from your hosting control panel and select the site’s database.
3. Check your table prefix. It is often wp_, but plenty of installs use something else. Look at the table list and use whatever comes before users.
4. Open the SQL tab and run the query the tool built for you, or edit the user_pass field directly in the wp_users row for your account.
5. Log in with the new password. If it works, delete the hash from wherever you pasted it.

One thing that catches people out: if you edit the row by hand in phpMyAdmin, make sure the function dropdown next to user_pass is left blank. Selecting MD5 there will hash your already-hashed value a second time and the login will fail.

Why your hash starts with $wp

This is the part most hash generators get wrong, and it is worth two minutes of your time.

WordPress 6.8 changed how passwords are stored. Before that release it used phpass, and hashes looked like $P$B.... Since 6.8 it uses bcrypt, but not plain bcrypt. Look at what wp_hash_password() does in wp-includes/pluggable.php:

$password_to_hash = base64_encode( hash_hmac( 'sha384', trim( $password ), 'wp-sha384', true ) );

return '$wp' . password_hash( $password_to_hash, $algorithm, $options );

The password goes through HMAC-SHA384 first, then bcrypt, and the result gets a $wp prefix bolted on the front. The SHA-384 step exists because bcrypt silently ignores anything past 72 bytes, so a long passphrase would lose its tail. Running it through SHA-384 first keeps all of that entropy.

So a real WordPress hash looks like this:

$wp$2y$10$R93L2NmanQa2BRokpx7kJO5WEXx840WQ68gZLXpx6k0OGd6C9a3/.

Not this:

$2y$10$iVQeWI7EkcwmxEsPmfix7e4czXB2s0ycGN2fSXHMp6Gm3Ena1npHC

A bare bcrypt hash will still let you in. wp_check_password() falls through to a plain password_verify() for anything it does not recognise. But WordPress marks it as needing a rehash the moment you log in, because it is not the current format. If you want the row to look exactly like every other user in the table, use the prefixed version.

What if the existing hashes start with $P$

Then the site is on WordPress 6.7 or older, or those accounts have not logged in since the upgrade. Use the legacy output from the second box above. WordPress still verifies phpass hashes and quietly upgrades them to the new format the next time that user signs in.

Common questions

Is it safe to type my password into this page?

The password is sent over HTTPS, hashed, and returned. Nothing is written to a database or a log file. That said, the safest habit with any online tool is to generate a throwaway password here, use it to get back into the site, then change it from inside wp-admin. The Strong password tab above will make you one.

Why is the hash different every time I click generate?

bcrypt mixes in a fresh random salt on every run. The same password produces a different hash each time, and all of them are valid. That is deliberate: it means two users with the same password do not end up with matching rows in the database.

Can I turn a hash back into the password?

No. Hashing only runs one way. If you have lost the password, generate a new hash and replace the old one. There is nothing to decrypt.

The query ran but I still cannot log in

Check these in order. Did you edit the right database, on sites where staging and live sit side by side? Did the query report one row changed rather than zero? Is the table prefix in your query the same as the one in wp-config.php? And is a security plugin locking you out for failed attempts rather than rejecting the password itself?

What are the salt keys for?

They sit in wp-config.php and they sign the cookies that keep people logged in. Replacing them logs every user out immediately, which is exactly what you want after cleaning up a compromised site. They have nothing to do with password hashes, but you tend to need both on the same bad afternoon, so the generator is on the second tab.