WordPress password hash checker
Paste a hash to identify its format instantly, then optionally test a candidate password against it. Nothing leaves your browser.
Supports $wp$2y$, $P$, bcrypt, and legacy MD5. It's safe to paste a hash here — a hash cannot be reversed into a password, and nothing you enter is transmitted; see the privacy page for what actually leaves the browser.
Quick answers
Is it safe to paste a production password hash here?
Yes for the hash itself — a hash cannot be reverse-engineered back into a password. This page runs entirely in your browser and makes no request with either the hash or the password; see the privacy page for exactly what does leave the browser.
What does $wp$2y$ mean?
It marks the current WordPress Core password format (6.8 and later): bcrypt applied to an HMAC-SHA-384 pre-hash of the password. Full explanation in the format guide.
My password is correct but the checker says no match — why?
The most common cause after a migration is comparing against the wrong database, or an incompletely imported one. It can also mean the account's password was actually changed. This exact scenario is covered in the login-after-migration guide.