EStore Tools

WordPress Password Hash Generator

A working password hash for a database-only reset, plus the safer WP-CLI command that hashes it correctly as a native WordPress 6.8+ bcrypt hash.

Describe the result you need. AI will set up the tool and ask for any missing details.

Configure with AI

Enter to submit · Shift + Enter for a new line

Sent to AI. Leave out passwords and private customer data.

Your details

Password hash and reset commands

wordpress-password-reset.sql.txt
-- WordPress still verifies this "phpass" hash format for login, even on WordPress 6.8+ (which
-- defaults new hashes to bcrypt): it rehashes automatically to bcrypt the next time this user
-- logs in successfully. So this works as a one-time reset, including from phpMyAdmin alone.

UPDATE wp_users SET user_pass = '$P$BX8KHmFVN2rbiMpU8G7iIfciLKQJ7S/' WHERE ID = 1;


# Safer alternative, if you have SSH/WP-CLI access: this hashes the password itself, correctly,
# as a native WordPress 6.8+ bcrypt hash ($wp$2y$10$...). No copy-pasting a generated hash at all.
wp user update 1 --user_pass='CorrectHorseBatteryStaple!7'

After logging in with this password, change it again from your profile (or ask the user to), so it isn't left sitting in your clipboard, shell history or this browser tab.

This is a byte-for-byte JS port of WordPress's own wp-includes/class-phpass.php (8192 rounds of MD5, verified against a real PHP run of that class before shipping), not a lookup table or an approximation.

A native WordPress 6.8+ hash looks like $wp$2y$10$... (bcrypt, wrapping a SHA-384 pre-hash). Producing that exact format needs WordPress's own PHP code, which is what the wp user update command above runs for you.

Two hash formats, one still fully supported

WordPress 6.8 changed how new password hashes are created, from the older "phpass" portable hash to bcrypt (format $wp$2y$10$..., wrapping a SHA-384 pre-hash so long passwords aren't silently truncated at bcrypt's 72-byte limit). Producing that exact bcrypt hash needs WordPress's own PHP code to run, which a browser tool can't do for you.

What WordPress's login code (wp_check_password()) still does, on every version including 6.8+, is verify the older phpass format too, for backward compatibility, then rehash it to bcrypt automatically the next time that login succeeds. That's what makes a phpass hash a genuinely useful, working password reset even today: this generator is a from-scratch JavaScript port of WordPress's own wp-includes/class-phpass.php, checked line for line against the real file, and its output was verified against a real PHP run of that exact class (same salt, five test passwords, byte-for-byte matching results) before this tool shipped.

$P$ + iteration-count character + 8-character salt + 22-character hash = 34 characters, from 8192 rounds of MD5
The same structure and round count as wp_hash_password() has always used for a portable hash.

Resetting a locked-out admin

  1. 01

    Only if you have no other way in

    Try WordPress's own "Lost your password?" link first if your site can still send email.

  2. 02

    No SSH or WP-CLI? Use the SQL

    Run the generated UPDATE statement in phpMyAdmin or Adminer, matched by user ID or username.

  3. 03

    Have SSH/WP-CLI? Use that instead

    wp user update <id-or-login> --user_pass='...' runs WordPress's own hashing code directly, producing a correct native bcrypt hash with nothing to copy and paste.

  4. 04

    Log in, then change the password again

    From your profile, so this generated password isn't left in your clipboard or shell history.

Pitfalls

  • This generates a real, working password hash. Treat the page like you'd treat pasting a password into any other tool: don't run it on a shared or untrusted computer.
  • Multisite installs share one wp_users table across every site; double-check you're matching the right ID before running the UPDATE.
  • If your host's phpMyAdmin escapes quotes differently, copy the query exactly rather than retyping it.

Questions people ask

Is this safe to use on a live store?

Yes, for a genuine locked-out recovery. Change the password again immediately after logging in, and prefer the WP-CLI command over the raw SQL whenever you have shell access.

Why not just generate a real $wp$2y$10$ bcrypt hash?

That format wraps a SHA-384 pre-hash inside PHP's own password_hash(), which needs WordPress's exact PHP implementation to reproduce correctly. Getting that subtly wrong would silently produce a hash that doesn't verify, worse than not offering it. wp user update runs WordPress's real code instead, so it's the safer path when you have CLI access.

Does the phpass hash still work after WordPress 6.8?

Yes. wp_check_password() keeps verifying it for login on every WordPress version, and rehashes it to bcrypt automatically after a successful login.

Does anything get sent to your server?

No. The password, salt and hash are all generated and computed entirely in your browser.

Related tools

WordPress Hardening Rules Generator.htaccess or Nginx hardening rules, plus a Content-Security-Policy header pre-filled for Stripe, PayPal and Google Pay.wp-config.php Generator for StoresStore-ready memory, cron, debug and security constants, each with a plain-English explanation, plus freshly generated authentication salts.WordPress Security CheckA read-only external scan for leaked version numbers, exposed backups, missing security headers and a few well-known information leaks.WooCommerce Database Cleanup QueriesRead-only diagnostic SQL first, then the matching WP-CLI commands to clean transients, sessions, Action Scheduler logs and more.

Want this builtinto your store?

I'm Emmanuel, a Shopify and WooCommerce developer. If this tool pointed at something you'd rather have fixed for you (a faster store, cleaner product data, a migration, a custom feature), send me a note.

Emmanuel Asika

Emmanuel Asika

Shopify & WooCommerce developer, Dublin

I build and fix online stores: new builds, migrations, speed, SEO and the custom bits apps can't do.

hello@emmanuelasika.com
See my work

Last reviewed 30 September 2026.

Sources: Make WordPress Core: WordPress 6.8 will use bcrypt for password hashing