PHP Native Password Hash
Makes WordPress use PHP's native password_hash() functions for portable, stronger, and time-attack safe bcrypt and Argon2 hashes.
The facts
- Rating
- 5★ from 6
- Active installs
- 1k+
- Price
- Free
- Last updated
- 10 Jun 2024
- Added
- Jan 2017
- Requires WP
- 5.2
- Tested up to
- WP 6.5.10
- Requires PHP
- 7.0
- Downloads
- 24,494
Our analysis
AI-assistedPHP Native Password Hash is a WordPress plugin that replaces the default password hashing mechanism with PHP's password_hash() function, which uses bcrypt and can also support the Argon2 algorithm. The plugin generates a unique salt for each password using a secure random number generator, enhancing security against attacks such as brute-force and dictionary attacks.
This plugin is suitable for WordPress users who need to ensure strong password security, especially in environments where passwords are shared between WordPress and other applications. It operates transparently, automatically rehashing existing passwords without requiring user intervention.
Best for: WordPress users looking to enhance password security across multiple applications.
What it does well
- ✓Replaces WordPress's core password hashing with PHP's password_hash()
- ✓Supports modern hashing algorithms like Argon2 if available
- ✓Generates unique salts for each password for enhanced security
- ✓Automatically rehashes existing passwords upon user login
- ✓Minimal footprint and designed for performance
Where it falls short
- •Limited information on specific user scenarios or configurations
Verdict
PHP Native Password Hash provides a straightforward solution for improving password security in WordPress. Its automatic handling of password rehashing makes it a practical choice for users concerned about security.
From the developer
Ayesh Karunaratne's own description of PHP Native Password Hash, lightly tidied.
This plugin swaps out WordPress core’s password hashing mechanism with PHP 5.5’s password_hash() and its accompanying functions. By default, PHP uses bcrypt to hash the passwords. If available, this plugin will use modern Argon2 algorithm. The transition will be transparent.
- A password salt will be generated using a Cryptographically Secure Pseudo-Random Number Generator (
CSPRNG) - Password hashes are safe from dictionary attacks with rainbow tables or any other precomputed hash lists, because a secure salt is generated for each password.
- The password hashing is iterated multiple times to provide a good resistance against brute-force attacks.
- Password checks are made in a way that it mitigates time-attacks.
- You do not have to reset passwords of all users. Passwords already hashed in the database will be rehashed automatically and transparently the next time the user logs in.
- PHP might come up with newer password hashing algorithms, and they will be automatically supported without having to reset all the passwords.
This plugin was made initially because one of our applications used WordPress for authentication, but we needed to use an external system
to verify the passwords directly from the database too. Since WordPress has its own password hashing algorithm, we decided to make this plugin to address that problem.
With this plugin, passwords generated by both WordPress and other custom applications now use the PHP’s default password_hash() functions without compromising any of the applications’ security.
This plugin is designed to be as minimal and fast as possible, and can be considered a must-use for EVERY WordPress application given the minimal footprint of this plugin, and considering the importance of using a secure hashing algorithm for passwords.