Page 1 of 1

How is the password hashed?

PostPosted: March 29th, 2011, 10:00 pm
by davei234
Hi,

I was wondering how to check the password stored in the `user_pass` field in the 'wp_users' database table. It doesn't appear to be a normal md5 hash. I want to be able to check the passwords so I could use the same users from s2member to login via software. Thanks.

Dave

Re: How is the password hashed?

PostPosted: March 31st, 2011, 1:37 am
by davei234
In other words:

md5 of "test":
098f6bcd4621d373cade4e832627b4f6
^^ this is easy to test for -- just do md5("test")

wordpress/s2member hash of "test":
$P$BMr8jTPjHHOl0g/P6OtOeT/fZZr71y0
^^ how do I test this password?

thanks..

Re: How is the password hashed?

PostPosted: March 31st, 2011, 4:35 am
by Jason Caldwell
Thanks for the excellent question.

You can use the "user_pass_ok()" function.
http://codex.wordpress.org/Function_Ref ... er_pass_ok

Re: How is the password hashed?

PostPosted: March 31st, 2011, 12:45 pm
by davei234
Thanks! By the way, here's how I was able to use user_pass_ok() outside of Wordpress:

Code: Select all
<?php

define( 'ABSPATH', dirname(__FILE__) . '/../web/' ); // directory of WordPress
require_once(ABSPATH.'wp-load.php');
require_once(ABSPATH.'wp-includes/wp-db.php');
require_once(ABSPATH.'wp-includes/cache.php');
require_once(ABSPATH.'wp-includes/formatting.php');
require_once(ABSPATH.'wp-includes/pluggable.php');
require_once(ABSPATH.'wp-includes/plugin.php');
require_once(ABSPATH.'wp-includes/user.php');

if (user_pass_ok("test", "test"))
{
   echo "good password";
}
else
{
   echo "bad password";
}

?>

Re: How is the password hashed?

PostPosted: March 31st, 2011, 8:47 pm
by Jason Caldwell
Nice work. Thanks for sharing this with us.
~ much appreciated!