Summery Summery

Checks the plaintext password against the encrypted Password.

Syntax Syntax

wp_check_password( string $password, string $hash, string|int $user_id = '' )

Description Description

Maintains compatibility between old version and the new cookie authentication protocol using PHPass library. The $hash parameter is the encrypted password and the function compares the plain text password when encrypted similarly against the already encrypted password to see if they match.

For integration with other applications, this function can be overwritten to instead use the other package password checking algorithm.

Parameters Parameters


(Required) Plaintext user's password


(Required) Hash of the user's password to check against.


(Optional) User ID.

Default value: ''

Return Return

(bool) False, if the $password does not match the hashed password

Source Source

File: wp-includes/pluggable.php

	 * @since 2.5.0
	 * @global PasswordHash $wp_hasher PHPass object used for checking the password
	 *                                 against the $hash + $password
	 * @uses PasswordHash::CheckPassword
	 * @param string     $password Plaintext user's password
	 * @param string     $hash     Hash of the user's password to check against.
	 * @param string|int $user_id  Optional. User ID.
	 * @return bool False, if the $password does not match the hashed password
	function wp_check_password( $password, $hash, $user_id = '' ) {
		global $wp_hasher;

		// If the hash is still md5...
		if ( strlen( $hash ) <= 32 ) {
			$check = hash_equals( $hash, md5( $password ) );
			if ( $check && $user_id ) {
				// Rehash using new hash.
				wp_set_password( $password, $user_id );
				$hash = wp_hash_password( $password );

			 * Filters whether the plaintext password matches the encrypted password.
			 * @since 2.5.0
			 * @param bool       $check    Whether the passwords match.
			 * @param string     $password The plaintext password.
			 * @param string     $hash     The hashed password.
			 * @param string|int $user_id  User ID. Can be empty.
			return apply_filters( 'check_password', $check, $password, $hash, $user_id );

		// If the stored hash is longer than an MD5,
		// presume the new style phpass portable hash.


Changelog Changelog

Version Description
2.5.0 Introduced.


Leave a Reply