WordPress password hash generator
Generates the real $wp$2y$ hash current WordPress stores — bcrypt with Core's SHA-384 pre-hash, not the older phpass format most generators still produce.
$wp$2y$How WordPress hashes it
Since WordPress 6.8, Core hashes a password in four steps rather than bcrypting it directly. This matters because it means a plain bcrypt hash — even a correctly-formed one — is not what WordPress actually stores.
This generator runs that exact sequence in your browser, so the value it produces is verifiable byte-for-byte against what wp_hash_password() would store. Full detail: why a hash starts with $wp$2y$.
Quick answers
Will this hash work on WordPress 6.7 or earlier?
No. Versions before 6.8 do not recognize the $wp$ prefix and cannot verify this format. Use the legacy phpass generator for those installs instead.
What bcrypt cost should I pick?
10 matches what WordPress Core uses by default and is a reasonable choice for most sites. 11 or 12 take longer to compute but resist offline cracking better; only raise it if your host's CPU budget for login requests can absorb the extra time.
Is this the same as running password_hash() in PHP?
Not directly. PHP's password_hash() would bcrypt the password itself. WordPress instead bcrypts an HMAC-SHA-384 of the password, which is what this generator reproduces.
Can I paste this hash straight into the database?
Yes — into the user_pass column of wp_users, replacing the existing value for that account. The SQL panel above fills in that statement automatically once a hash is generated.