WordPress Password Hash Generator

Locked out of your own WordPress site and the reset email is not coming? You are not stuck. There is a way back in that does not need email at all, and it takes about ten minutes.

Generate your new password below, then follow the walkthrough underneath. If you are in a hurry, the short version is: this gives you a scrambled version of your password, and you paste that into your site’s database in place of the old one.

First, are you sure you need this?

Editing a database by hand is a real thing to do carefully, so it is worth thirty seconds ruling out the easier options.

Try these first, they take a minute each:

• Check your spam folder. Reset emails land there constantly.
• Do you have another admin account? Log in with that one and change the first account’s password from Users.
• Are you still logged in on your phone or another browser? If any device still has you signed in, go to Users and reset it from there.
• Is it actually the password? If you get “too many failed attempts”, a security plugin has locked you out temporarily and a new password will not help. Wait fifteen minutes.

None of those? Then the database route is the right answer, and it is the same method a developer would use.

Why the reset email never arrives

Worth knowing, because it explains why waiting longer will not fix it.

WordPress does not really send email. It hands the message to the server and hopes. On most shared hosting that message is quietly dropped, or accepted and then binned by Gmail because it arrived from a server with no permission to send as your domain.

So the email is not late. It was never sent, or it was thrown away on arrival. No amount of clicking Lost Password will change that.

Once you are back in, installing an SMTP plugin fixes it permanently, and is worth doing before it happens again.

Getting back in

You need your hosting login for this, not your WordPress login. The account you pay for hosting with.

1. Make your new password

In the tool above, type the password you want and press Generate hash. Copy the first result, the one marked WordPress 6.8 and newer.

It will start with $wp$2y$10$ and look like nonsense. That is correct. WordPress never stores your actual password, only this scrambled version, and the scrambling only works one way.

2. Find phpMyAdmin

This is the tool for looking inside your site’s database. Your host provides it.

• Hostinger: hPanel, then Databases, then phpMyAdmin, then Enter.
• cPanel hosts: the Databases section, then phpMyAdmin.
• SiteGround: Site Tools, then Site, then MySQL, then phpMyAdmin.

Some hosts use Adminer instead. It looks different but works the same way.

3. Find the right database

Down the left side is a list of databases. If there is only one, that is it.

If there are several, you need the one your site actually uses, and guessing wrong wastes an afternoon. Open your File Manager, find wp-config.php in public_html, and look for this line:

define( 'DB_NAME', 'u123456_wp789' );

The name in quotes is your database. While you are in that file, note the line just below the database settings:

$table_prefix = 'wp_';

Usually wp_, but plenty of installs use something else for security. You need it in a moment.

4. Back up before you touch anything

Please do not skip this. It takes twenty seconds and it is the difference between a mistake and a disaster.

Click your database name, then the Export tab at the top, then Go. A file downloads. Keep it somewhere you can find it. If anything goes wrong, that file puts everything back.

5. Change the password

Two ways. The first is easier to understand, the second is faster.

By hand:

1. In the table list on the left, click wp_users. If your prefix was different, it will be that instead, for example xy7_users.
2. You will see your user accounts. Find yours by the user_login column.
3. Click Edit on that row.
4. Find the user_pass field. Delete everything in it and paste your new hash.
5. Important: there is a dropdown next to that field labelled Function. Leave it blank. If you pick MD5 there, your already scrambled password gets scrambled a second time and the login will fail.
6. Scroll down and click Go.

Or with the ready made query:

The tool at the top of this page builds one for you. Put your table prefix and username into the two small boxes, copy the query, click the SQL tab in phpMyAdmin, paste, and press Go.

It should say 1 row affected. If it says 0 rows, the username did not match anything. Check the spelling against the user_login column, and remember it is the login name, not your display name or your email.

6. Log in

Go to your login page and use the password you typed into the tool, not the scrambled version. Use a private browser window so an old saved password does not confuse things.

Once you are in, change the password again from Users, so the one you typed into a website is no longer the live one.

Why the hash starts with $wp

This is the part most other generators get wrong, and it is worth two minutes because it explains why a hash from elsewhere might not work.

WordPress 6.8 changed how passwords are stored. Before that, hashes started with $P$B. Since then they use bcrypt, but not plain bcrypt. Here is the actual code from wp-includes/pluggable.php:

$password_to_hash = base64_encode( hash_hmac( 'sha384', trim( $password ), 'wp-sha384', true ) );

return '$wp' . password_hash( $password_to_hash, $algorithm, $options );

The password goes through SHA-384 first, then bcrypt, then gets $wp stuck on the front. That first step exists because bcrypt ignores anything past 72 characters, so a long passphrase would lose its tail. Running it through SHA-384 first keeps all of it.

So a genuine WordPress hash looks like this:

$wp$2y$10$R93L2NmanQa2BRokpx7kJO5WEXx840WQ68gZLXpx6k0OGd6C9a3/.

Not this:

$2y$10$iVQeWI7EkcwmxEsPmfix7e4czXB2s0ycGN2fSXHMp6Gm3Ena1npHC

A plain bcrypt hash will still let you in, because WordPress falls back for anything it does not recognise. But it flags the account for rehashing the moment you log in, because it is not the current format. If you want the row to look like every other user in the table, use the prefixed one. This tool calls WordPress’s own function, so what you get is exactly what WordPress would have written itself.

What if the existing hashes start with $P$

Then the site is on WordPress 6.7 or older, or those accounts have not logged in since it was updated. Use the second box in the tool. WordPress still accepts that format and quietly upgrades it the next time the person signs in.

It did not work

Work through these in order. It is nearly always one of the first three.

The query ran but said 0 rows affected

Nothing was changed. The username in the query does not match any row. Look at the user_login column in wp_users and copy it exactly, capitals included. It is the login name, not the display name and not the email.

It said 1 row affected but the password is still refused

Almost certainly the Function dropdown was set to MD5 when you saved. That hashed your hash. Go back, paste the value again with the dropdown blank, and save.

The other possibility is a stray space at the start or end of the pasted value. Delete the whole field and paste again carefully.

You edited the wrong database

Common when a staging copy sits next to the live site. Check DB_NAME in wp-config.php and make sure it matches the database you had open.

You get “too many failed attempts”

A security plugin has blocked your IP address, and it will keep blocking regardless of how correct your password is. Wait fifteen minutes, or if you cannot wait, rename the plugin’s folder in wp-content/plugins using File Manager. Renaming disables it, and WordPress will let you in.

Two other things this tool does

Both are on the tabs at the top of the tool, and both are useful for the situation that usually brings people here.

Salt keys

Eight long random lines that live in wp-config.php. They sign the cookies that keep people logged in.

Replacing them logs out every single session immediately, everywhere. That is exactly what you want if you suspect someone else got into your site, because changing the password alone does not kick out anyone already signed in. Their cookie keeps working until it expires.

To use them: open wp-config.php, find the eight lines beginning define( 'AUTH_KEY' and so on, delete all eight, and paste the new set in their place. Everyone including you is signed out. Nothing else breaks.

Strong password

Makes a random password in your browser. Nothing is sent anywhere for this one. Handy for generating the throwaway password mentioned earlier, or just for a decent one you will store in a password manager.

Questions people ask

Is it safe to type my password here?

It travels over HTTPS, gets hashed, and comes straight back. Nothing is written to a database or a log.

Even so, the sensible habit with any online tool is to use a throwaway password to get back in, then change it properly from inside WordPress. The Strong password tab will make you one.

Why does the hash change every time?

bcrypt mixes in a fresh random salt on each run, so the same password gives a different hash every time. All of them are valid. It is deliberate: it means two people with the same password do not end up with matching rows in the database.

Can I turn a hash back into the password?

No, and neither can anyone else, including WordPress. Hashing runs one way only. That is the entire point of it. If the password is lost, you replace the hash, which is what this page is about.

Will this log everyone else out?

No. Changing one password affects one account, and anyone already signed in stays signed in. If you want everyone out, that is the salt keys on the second tab.

My host has no phpMyAdmin

Some managed hosts hide it. Two other routes: many offer Adminer, which works the same way, or if you have SSH access you can use WP-CLI with wp user update, which does the whole job in one command and needs no hash at all.