Required PHP 5.5 or later
This plugin swaps out WordPress core’s password hashing mechanism with PHP 5.5’s
password_hash() and its accompanying functions. By default, PHP uses BCrypt to hash the passwords.
- A password salt will be generated using a Cryptographically Secure Pseudo-Random Number Generator (
- Password hashes are safe from dictionary attacks, because a secure salt is generated for each password.
- The password is hashing is iterated multiple times to provide a good resistivity for brute-force attacks.
- Password checks are made in a way that mitigates time-attacks.
- You do not have to reset passwords of all users. Passwords already hashed in the database will be rehashed automatically and transparently the next time the user logs in.
- PHP might come up with newer password hashing algorithms, and they will be automatically supported without having to reset all the passwords.
This plugin was made initially because one of our applications used WordPress for authentication, but we needed to use an external system
to verify the passwords directly from the database too. Since WordPress has its own password hashing algorithm, we decided to make this plugin to address that problem.
With this plugin, passwords generated by both WordPress and other custom applications now use the PHP’s default
Other than portability, this plugin makes it possible for your WordPress site to take advantage of the latest features if they are available on your system.