About WPSalt

Methodology and compatibility

WPSalt is a small open-source collection of browser-based utilities for WordPress password hashes and authentication keys. It is designed for administrators and developers working on systems they are authorized to maintain.

How password hashes are produced

The legacy tool implements WordPress portable phpass hashes. The modern tool follows WordPress Core’s wp_hash_password(): it trims the password, computes a SHA-384 HMAC with the wp-sha384 domain-separation key, Base64-encodes that result, bcrypts it, and adds the $wp prefix.

Hash verification follows wp_check_password() for $wp$2y$, $P$, plain bcrypt, and legacy MD5 values. The implementation and third-party license are available in the public source repository.

Verification status

Last compatibility review: WordPress 7.0.2 reference implementation, 26 July 2026. Compatibility claims are reviewed against the official hashing and verification references.

Responsible use

Use the tools only for sites and accounts you administer. For production recovery, prefer WordPress’s own password-reset flow or WP-CLI. If you must use a web tool, use a throwaway credential whenever possible and keep generated secrets out of chat logs, tickets, and source control.