Viktor Szépe

wp-password-bcrypt is a WordPress plugin to replace WP’s outdated and insecure 
MD5-based password hashing with the modern and secure <a href="https://en.wikipedia.org/wiki/Bcrypt" rel="nofollow ugc">bcrypt</a>.
It is written by <a href="https://roots.io/plugins/bcrypt-password/" rel="nofollow ugc">roots.io people</a>.
This plugin requires PHP >= 5.5.0 which introduced the built-in 
<a href="http://php.net/manual/en/function.password-hash.php" rel="nofollow ugc"><code>password_hash</code></a> and 
<a href="http://php.net/manual/en/function.password-verify.php" rel="nofollow ugc"><code>password_verify</code></a> functions.
See <a href="https://roots.io/improving-wordpress-password-security/" rel="nofollow ugc">Improving WordPress Password Security</a> 
for more background on this plugin and the password hashing issue.

Password bcrypt

Every WordPress installation needs password hashing with bcrypt. Thanks :)

Important plugin!

Simply the best

Replaces wp_hash_password and wp_check_password with PHP 5.5's password_hash and password_verify.

Ayesh Karunaratne

This plugin swaps out WordPress core’s password hashing mechanism with PHP 5.5’s <code>password_hash()</code> and its accompanying functions. By default, PHP uses bcrypt to hash the passwords. If available, this plugin will use modern Argon2 algorithm. The transition will be transparent.
<ul>
<li>A password salt will be generated using a Cryptographically Secure Pseudo-Random Number Generator (<code>CSPRNG</code>)</li>
<li>Password hashes are safe from dictionary attacks with rainbow tables or any other precomputed hash lists, because a secure salt is generated for each password.</li>
<li>The password hashing is iterated multiple times to provide a good resistance against brute-force attacks.</li>
<li>Password checks are made in a way that it mitigates time-attacks.</li>
<li>You do not have to reset passwords of all users. Passwords already hashed in the database will be rehashed automatically and transparently the next time the user logs in.</li>
<li>PHP might come up with newer password hashing algorithms, and they will be automatically supported without having to reset all the passwords.</li>
</ul>
This plugin was made initially because one of our applications used WordPress for authentication, but we needed to use an external system 
to verify the passwords directly from the database too. Since WordPress has its own password hashing algorithm, we decided to make this plugin to address that problem. 
With this plugin, passwords generated by both WordPress and other custom applications now use the PHP’s default <code>password_hash()</code> functions without compromising any of the applications’ security.
This plugin is designed to be as minimal and fast as possible, and can be considered a must-use for EVERY WordPress application given the minimal footprint of this plugin, and considering the importance of using a secure hashing algorithm for passwords.

PHP Native Password Hash

Makes WordPress use PHP's native password_hash() functions for portable, stronger, and time-attack safe bcrypt and Argon2 hashes.

Password bcrypt vs PHP Native Password Hash