About WPSalt

Methodology and compatibility

WPSalt is a small open-source collection of browser-based utilities for WordPress password hashes and authentication keys. It is designed for administrators and developers working on systems they are authorized to maintain.

How password hashes are produced

The legacy tool implements WordPress portable phpass hashes. The modern tool follows WordPress Core’s wp_hash_password(): it trims the password, computes a SHA-384 HMAC with the wp-sha384 domain-separation key, Base64-encodes that result, bcrypts it, and adds the $wp prefix.

Hash verification follows wp_check_password() for $wp$2y$, $P$, plain bcrypt, and legacy MD5 values. The implementation and third-party license are available in the public source repository.

How it's verified

Each hasher is checked against WordPress Core's own PHP implementation in both directions: a hash produced by this site's JavaScript is confirmed to verify successfully against a real WordPress installation, and a hash produced by that WordPress installation is confirmed to verify successfully here — not just that the two implementations agree with each other, which could mean they share the same bug. The phpass implementation is checked against WordPress's class-phpass.php the same way. This is a manual review process, not an automated test running against live WordPress on every deploy; the review date below reflects when it last ran.

Last compatibility review: WordPress 7.0.2 reference implementation, 26 July 2026. Compatibility claims are reviewed against the official hashing and verification references.

Responsible use

Use the tools only for sites and accounts you administer. For production recovery, prefer WordPress’s own password-reset flow or WP-CLI. If you must use a web tool, use a throwaway credential whenever possible and keep generated secrets out of chat logs, tickets, and source control.

Who maintains this

WPSalt is maintained by CommanderWaterford. The source is public, so the hashing logic described above can be read and checked directly rather than taken on trust — that is also the fastest way to verify what a specific version of the site actually does. Found a compatibility issue, a bug, or a WordPress version this hasn't been checked against yet? Open an issue on GitHub.