How WordPress Handles Password Hashing: Bcrypt, MD5, and Security Explained

Reading Time: 2 min, 41 sec

Passwords are one of the most critical parts of website security. If you run a WordPress site, it is important to understand how WordPress stores and protects user passwords. Over the years, WordPress has improved its password security to keep up with modern standards. In this guide, I will explain how WordPress handles password hashing, why it uses certain algorithms, and how legacy passwords are managed.

What Is Password Hashing?

Password hashing is the process of converting a password into a fixed-length string of characters using a cryptographic algorithm. WordPress never stores plain-text passwords. Instead, it stores a hash in the database.

When a user logs in, WordPress compares the hash of the entered password with the stored hash to verify it. This way, even if your database is compromised, attackers cannot see the actual passwords.

Modern WordPress Uses Bcrypt

Since WordPress 3.7, passwords are hashed using bcrypt, which is implemented in PHP through the password_hash() function.

Why bcrypt?

Bcrypt is slow and computationally intensive, which makes brute-force attacks much harder.

It includes a cost factor that determines how resource-intensive the hashing is, allowing WordPress to adjust security over time.

WordPress automatically uses PHP’s password_verify() function to check passwords during login.

Example of a bcrypt hash in WordPress:

$2y$10$VbK5F4z6F6DjlM78qXyFzO6DlP/5XlYxE5xjLox5RCJGj3bEoI0Fe

Here:

$2y$ indicates the bcrypt algorithm.

10 is the cost factor.

Legacy MD5 Passwords

Before WordPress 3.7, passwords were hashed using MD5. MD5 is much faster and less secure compared to bcrypt, and it is vulnerable to modern cracking techniques.

For backward compatibility, WordPress still supports MD5 passwords stored in older databases. However, it does not generate new MD5 hashes.

Automatic Upgrade to Bcrypt:

When a user with an MD5 password logs in, WordPress automatically rehashes their password using bcrypt and updates the database. This ensures every password eventually uses a secure hashing algorithm without forcing users to change their password.

How WordPress Verifies Passwords

WordPress follows these steps when a user logs in:

• Retrieve the hash stored in the wp_users table.
• Check if the hash is bcrypt or MD5.
• If MD5, compare it with the entered password, then immediately rehash it using bcrypt and update the database.
• If bcrypt, use password_verify() to check the password.

This approach ensures security while maintaining compatibility with older sites.

Security Advantages of WordPress Password Handling

• Strong hashing: Bcrypt is resistant to brute-force attacks.
• Automatic upgrades: Legacy passwords are upgraded to bcrypt on login.
• Cost factor: WordPress can increase the computational difficulty over time without breaking existing passwords.

Best Practices for WordPress Site Owners

if you manage a WordPress website, I recommend using strong and unique passwords. You should consider enabling two-factor authentication for extra security. Always, keep WordPress, plugins, and themes updated to benefit from the latest security features.You should also regularly audit your user accounts and remove inactive or suspicious accounts.

Conclusion

WordPress has evolved from using MD5 to bcrypt to ensure strong password security. With automatic rehashing, legacy passwords are upgraded seamlessly, protecting your users without interrupting their experience. By understanding how WordPress handles password hashing, you can better secure your site and educate users on best practices.