WP Modern Password Hashing

For legacy support with a wider range of PHP versions, WordPress opts to use PHPASS (a portible password hashing library) which WordPress defaults to using a MD5 based hash.

The security of your password hashes can be improved by using a modern password hashing algorithm, such as BCRYPT for PHP 5.5+ or ARGON2I for PHP 7.2+

This plugin aims to improve the security of the hashed passwords by using PHP 5.5’s password_hash() function and the BCRYPT algorithm but also supports the newer ARGON2I algorithm.

For extended support when password_hash() is not available this plugin will fallback to using PHPASS with additional security when compared to the WordPress defaults.

1. Upload the plugin folder to the /wp-content/plugins directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress.
3. User passwords will be rehashed on the next successful login.

How do I use ARGON2I

Currently you will need to update the alorithm in ‘wp-modern-password-hashing.php’ line 18, from PASSWORD_BCRYPT to PASSWORD_ARGON2I
Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

How do I use BCRYPT

If PHP 5.5 or higher is used, then password_hash() will be available, and the plugin will default to using it.

Can I change between ARGON2I and BCRYPT?

Provided you change the alorithm in ‘wp-modern-password-hashing.php’ line 18.
Keep in mind that updates will undo your change, I plan to add an options screen to wp-admin.

Yes, you should be able to change back and forth (Provided your PHP version is suffcient), as the password will be checked against the password_verify and password_needs_rehash functions.

What about Legacy support?

In cases where password_hash() is not available, PHPASS as included with WordPress will be used, but with two adjustments.
The rounds/iterations_count option and the use_md5/portable_hashes have been adjusted from the WordPress defaults of ‘8, true’ to ’16, false’
This should improve the security of the hashed passwords, for those who are running on older versions of PHP.

1.0.1

• Changed: Cases of array being shorthanded to [];, to array(); for improved compatibility.
• Changed: Function comments.
• Changed: Tags.
• Added: A few comments to various bits of code/functions.
• Added: Check for ‘$2y$’ in PHPASS section of wp_check_password(), to improve compatibility where password_verify() is not available.
• Added: In cases where password_verify() is not available and password is prefixed with ‘$2y$’, rehash password back to PHPASS ‘$P$’ or ‘$2a$’
• Added: Column to ‘All Users’ page, to display the detected algorithm of each user (MD5, $P$, $2a$, $2y$ and $argon2i$)

1.0.0

• Initial release.