WordPress Password Generator
Generate a strong password and the exact hash WordPress stores in wp_users.user_pass — phpass $P$B for any version, or $wp$2y$ bcrypt for 6.8+ — with ready WP-CLI, phpMyAdmin and SQL snippets.
The password is drawn here; the hash is made on our server
Neither of WordPress's two formats can be computed in a browser, so the value is sent over HTTPS for PHP to hash. It is never written to a log, a database or a file, and it is gone the moment the response is sent. Use this for a new password you are about to set — not for one you already use elsewhere.
WordPress Password Generator
Result
wp_users.user_pass
- Format
- Rounds
- Length
- Works on
Do not use this hash. It failed the round-trip check against wp_check_password()'s own logic, which should be impossible — please report it rather than pasting it into a database.
Whitespace removed.
wp_hash_password() trims before it hashes, so the spaces at the edges of your password are not part of it. Worse, wp_check_password() does not trim, so if you keep typing them the login will fail. Use the trimmed form.
You chose cost ; WordPress hashes at PHP's default of . The hash works, but wp_password_needs_rehash() compares against the default, so WordPress will quietly replace it the next time that user logs in.
The $wp in front is not decoration — it is how WordPress tells its own bcrypt hashes from anyone else's. Store all 63 characters. On WordPress 6.7 or older this string will not verify at all, and the login page will simply say the password is wrong.
All 34 characters go in the one column — the salt is the 8 characters after $P$B, which is why hashing the same password twice gives two different values and both still work. WordPress 6.8 accepts this and upgrades it to bcrypt on that user's next login.
- Stored format
- Work factor
- Check took
Written by .
This is the trim bug.
The password matches once its leading and trailing whitespace is removed. wp_hash_password() trims, wp_check_password() does not, so a password stored with spaces at the edges can never be typed back in. Reset it to the trimmed form.
On WordPress 6.8 or newer wp_password_needs_rehash() flags this one, so core will replace it with a fresh bcrypt hash the next time that user signs in. Nothing for you to do — it just means the row you are looking at is about to change.
Get it into your site
The prefix is whatever $table_prefix is set to in wp-config.php. It changes the table names and two meta keys, which is the usual reason a recovery query runs without error and changes nothing.
If WP-CLI or the admin screen is available, use one of those instead — they let WordPress pick the format its own version writes. A hash pasted by hand is for the locked-out case.
100% Free
All tools are completely free to use.
Privacy First
Your files are never uploaded or stored on our servers.
Super Fast
Compress and process files in seconds.
High Quality
Best results with minimal quality loss.
What is WordPress Password Generator?
WordPress Password Generator does the two things you need together when you are locked out of a site: it draws a strong random password, and it turns that password into the exact string WordPress expects to find in the user_pass column of wp_users.
Two formats, and picking the wrong one locks you out
WordPress changed how it hashes passwords in version 6.8, released in April 2025, and both formats are still in use.
The older one is phpass, the portable hash that starts $P$B and is exactly 34 characters long. It is an MD5 chain run 8,192 times over the password and an 8-character salt. Every WordPress from 2.5 onwards accepts it, including 6.8 and later — which makes it the safe choice when you do not know what version the site is running.
The newer one is bcrypt, stored as 63 characters beginning $wp$2y$. That $wp in front is not decoration: it is how core tells its own hashes from anyone else's, and wp_check_password() strips it before calling password_verify(). It is far stronger than phpass, but WordPress 6.7 and earlier cannot read it, and a login attempt against one just fails with no useful message.
Why WordPress bcrypt has no 72-byte limit
Bcrypt everywhere else silently ignores everything past the first 72 bytes of a password, which is how two different long passphrases can open the same account. WordPress avoids it: before bcrypt sees anything, the password is run through an HMAC-SHA-384 under the fixed key wp-sha384 and base64-encoded. That is always 64 characters, whatever went in — so a 300-character passphrase is fully accounted for, and this tool will not quietly truncate it the way a general-purpose bcrypt generator does.
Getting it into the database
Once you have a hash, the output gives you the snippets to place it: the WP-CLI commands to reset a user or create an administrator, an UPDATE for phpMyAdmin when the site will not boot, a full INSERT that builds an admin account from nothing including the two usermeta rows that actually grant the role, and a throwaway mu-plugin for when FTP is all you have. The table prefix from your wp-config.php is applied throughout — including to the wp_capabilities and wp_user_level meta keys, which carry it too and are the usual reason a hand-written recovery query runs cleanly and changes nothing.
What happens on our side
The password is drawn in your browser with crypto.getRandomValues(), the same generator a password manager uses, from a pool that leaves out quotes, backslashes, dollar signs and backticks — because this password has to survive a shell command, an SQL statement and a PHP string on its way in.
The hashing is the one part that cannot happen in your browser, so that value is sent over HTTPS, hashed, checked once against the same logic wp_check_password() uses, and discarded. Nothing is logged or stored. Use this for a password you are about to set, not one you already rely on.
How to Use WordPress Password Generator
-
1
Pick the hash format
phpass works on every WordPress version; bcrypt is stronger but needs 6.8 or newer. Choose phpass if you are unsure which the site runs.
-
2
Press Generate password
The password is drawn in your browser and sent to be hashed into a real WordPress user_pass value.
-
3
Copy the password first
It cannot be recovered from the hash. Save it in your password manager before you leave the page.
-
4
Set your username and table prefix
The prefix is $table_prefix from wp-config.php. It changes the table names and the two capability meta keys in the snippets.
-
5
Run the snippet that fits
WP-CLI if you have shell access, the UPDATE statement in phpMyAdmin if the site will not boot, or the mu-plugin if all you have is FTP.
-
6
Check it if you want to
Switch to Verify, paste a user_pass value straight from wp_users, and see whether WordPress would accept that password.