/ Plugin Category

/ Security & Privacy

/ Security Scanning & Malware Protection

/ PHP Native Password Hash

PHP Native Password Hash

By Ayesh Karunaratne

Security & Privacy / Security Scanning & Malware Protection

Reviewed by Omar Dabbas

Trusted WordPress expert with 20+ years of experience evaluating plugins for the WP ecosystem.

PHP Native Password Hash Review - In-Depth Analysis

Enhances WordPress password security by using PHP's native password_hash() functions. It supports bcrypt and Argon2 hashing algorithms for stronger password protection.

Performance Overview

WPS Score

6.83/10

User Rating

5/5 (based on 6+ reviews)

Active Installations

1,000+

Update Frequency

Below Average It is calculated using the weighted average of same category plugins.

Security Score

1 / 10 (Very Low Risk) It is calculated using the weighted average of all versions.

What It Does

This plugin swaps out WordPress core's password hashing mechanism with PHP 5.5's password_hash() and its accompanying functions. By default, PHP uses bcrypt to hash the passwords. If available, this plugin will use the modern Argon2 algorithm. The transition will be transparent.

A password salt will be generated using a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG). Password hashes are safe from dictionary attacks with rainbow tables or any other precomputed hash lists, because a secure salt is generated for each password. The password hashing is iterated multiple times to provide a good resistance against brute-force attacks.

Password checks are made in a way that mitigates time-attacks. You do not have to reset passwords of all users. Passwords already hashed in the database will be rehashed automatically and transparently the next time the user logs in. PHP might come up with newer password hashing algorithms, and they will be automatically supported without having to reset all the passwords.

This plugin was made initially because one of our applications used WordPress for authentication, but we needed to use an external system to verify the passwords directly from the database too. Since WordPress has its own password hashing algorithm, we decided to make this plugin to address that problem. With this plugin, passwords generated by both WordPress and other custom applications now use PHP's default password_hash() functions without compromising any of the applications' security.

This plugin is designed to be as minimal and fast as possible, and can be considered a must-use for EVERY WordPress application given the minimal footprint of this plugin, and considering the importance of using a secure hashing algorithm for passwords.

Comparing to Alternatives

PHP Native Password Hash is a unique plugin with no close direct alternatives in its category, focusing on native password hashing functionality.

Top alternatives

Strengths

Utilizes WordPress built-in functions for password hashing
Lightweight and simple to use
Enhances security by replacing outdated MD5 hashing
Consistently updated and maintained
No known security vulnerabilities

Weaknesses

Limited to password hashing functionality only
No premium or extended features available
Lacks integration with other security plugins

User Sentiment Analysis

With a perfect 5-star rating from all reviewers, user feedback is overwhelmingly positive, highlighting the plugin's effectiveness and simplicity.

Positive highlights

"It's Working fine. Thanks…" — Thilina Dharmasena
"Geniality is in simplicity." — birkof007
"Works as expected." — mpompas
"Does exactly what you want, using WordPress built in functions, so totally lightweight." — minishman
"Thanks for this plugin and especially for keeping it up to date." — Yambub

Common complaints

Weaknesses

No advanced features beyond basic password hashing
No paid version or premium support options
Limited scope may not meet all security needs

Who Should Use This?

Best for

Users seeking a straightforward, lightweight plugin to improve password hashing security using native WordPress functions will find this plugin ideal.

Not ideal for

Those looking for a comprehensive security suite or advanced password management features may find this plugin too limited for their needs.

Pricing & Value

Free version includes

The free version offers essential password hashing improvements using native WordPress functions with no cost.

Final Verdict

PHP Native Password Hash stands out for its simplicity and effectiveness, providing a much-needed update to WordPress password security without adding complexity. Its perfect user ratings and lack of security vulnerabilities make it a trustworthy choice for users wanting to enhance password hashing.

However, its narrow focus and absence of advanced features or premium support mean it may not satisfy users seeking a more comprehensive security solution. Overall, it is a valuable tool for those prioritizing lightweight, native functionality in password security.

Other Notable Features

Here are a few other notable features of this free PHP Native Password Hash plugin.

Argon2

Bcrypt

Password hashing

FAQ

Nope! This plugin is smart enough to identify an old password hash, capable to seamlessly validate it using the old algorithm, and update the hash with the new version automatically. Your users wouldn’t notice a thing.

To keep the plugin size minimal, this plugin does not offer a UI configuration page. You can set the password hashing
algorithm with a configuration value set in wp-config.php file.

Open your wp-config.php file at the root of your WordPress site, and find the line that says That's all, stop editing! Happy publishing.
Above this line, you can configure the hashing algorithm you want this plugin to use. Note that a wrong configuration value
means your users will not be able to log in until you fix this configuration option. It’s not recommended that you set
this configuration value unless you know what you are doing.

define( 'WP_PASSWORD_HASH_ALGO', PASSWORD_ARGON2ID );

You can use the following values depending on your PHP version:
– PHP 7.2 or later: PASSWORD_ARGON2I
– PHP 7.3 or later: PASSWORD_ARGON2ID (recommended)

Alrighty folks, read carefully: This plugin can listen to a configuration option you specify and pass it along to the hashing
process. Please make sure you are absolutely sure about the values you set here. If you set a value too easy to crack,
you will open up a security vulnerability in your site. If you set a value too high, your server will take too much resources.

This plugin does not make any effort to validate the configuration you set. If you do not configure a value, plugin will
use the default value your PHP version comes with.

If you would still like to configure these options, similar to the way you set the hashing algorithm, open the wp-config.php
file for your WordPress site (at root of your WordPress installation), and right below the line that you configure hashing
algorithm (see FAQ above), set your configuration values as well. Here is an example (not necessarily a recommendation):

define( 'WP_PASSWORD_HASH_OPTIONS', ['memory_cost' => 2<<16, 'time_cost' => \PASSWORD_ARGON2_DEFAULT_TIME_COST, 'threads' => \PASSWORD_ARGON2_DEFAULT_THREADS]] );

The values you set here will be different based on the algorithm you set. You must set the WP_PASSWORD_HASH_ALGO
configuration in order for this to be effective.

See https://www.php.net/manual/en/password.constants.php for more examples and information.

Existing password hashes will be updated the next time the user logs in. Existing hashes will be checked using the existing algorithm regardless of this configuration.