Title: WordPress password hashing
Last modified: August 19, 2016

---

# WordPress password hashing

 *  Resolved [mtinsley](https://wordpress.org/support/users/mtinsley/)
 * (@mtinsley)
 * [15 years, 5 months ago](https://wordpress.org/support/topic/wordpress-password-hashing/)
 * So out of curiosity I went digging through the code today to figure out how wordpress
   was storing passwords. I was a little surprised to find that the underlying hash
   function used in the phpass class was md5.
 * The reason given in the code is as follows:
 * > We’re kind of forced to use MD5 here since it’s the only cryptographic primitive
   > available in all versions of PHP currently in use
 * Keep in mind that this class was written in 2006 (according to the comments).
 * The sha1 function was introduced in PHP 4.3 (in 2002), which is also the minimum
   version of PHP required by wordpress. I wonder if it is time to consider updating
   that code.
 * To be honest I’m not certain of the issues that would arise from changing password
   storage method.
 * If you look at the code there is a lot going on beyond md5, but I still wonder
   how much more collision resistant the resulting hash is compared to md5. From
   wikipedia:
 * >  The security of the MD5 hash function is severely compromised. A collision
   > attack exists that can find collisions within seconds on a computer with a 
   > 2.6Ghz Pentium4 processor (complexity of 2^24.1)

Viewing 3 replies - 1 through 3 (of 3 total)

 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [15 years, 5 months ago](https://wordpress.org/support/topic/wordpress-password-hashing/#post-1824286)
 * That’s a very interesting question. I recommend contacting [security@wordpress.org](https://wordpress.org/support/topic/wordpress-password-hashing/security@wordpress.org?output_format=md)
   for more details.
 *  Thread Starter [mtinsley](https://wordpress.org/support/users/mtinsley/)
 * (@mtinsley)
 * [15 years, 5 months ago](https://wordpress.org/support/topic/wordpress-password-hashing/#post-1824316)
 * Actually it looks like I jumped to conclusions. On closer inspection of the code
   it seems like md5 is used as a fallback. phpass will attempt to use blowfish 
   and extended des before using md5 as a last resort.
 * It seems very unlikely that wordpress would have to resort to md5. Support for
   blowfish doesn’t depend on PHP, but on the OS. I’m guessing most major OSs support
   either blowfish or extended des. In addition to this, as of version 5.3 PHP has
   its own implementation of both of those algos.
 * Still, since the minimum PHP requirement is 4.3 and provided there won’t be too
   many side effects it might be a good idea to switch out md5 for sha1.
 *  [michaelyap](https://wordpress.org/support/users/michaelyap/)
 * (@michaelyap)
 * [15 years, 4 months ago](https://wordpress.org/support/topic/wordpress-password-hashing/#post-1824690)
 * I’m actually writing a 3rd party app that needs to authenticate against wordpress’
   credentials. The app will not be running on wordpress’ container and is not written
   in Php (hence cannot use wp’s api). Is there any way to know for sure which algo
   is being used ?

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘WordPress password hashing’ is closed to new replies.

## Tags

 * [password](https://wordpress.org/support/topic-tag/password/)

 * In: [Hacks](https://wordpress.org/support/forum/plugins-and-hacks/hacks/)
 * 3 replies
 * 3 participants
 * Last reply from: [michaelyap](https://wordpress.org/support/users/michaelyap/)
 * Last activity: [15 years, 4 months ago](https://wordpress.org/support/topic/wordpress-password-hashing/#post-1824690)
 * Status: resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics