wp-bcrypt
wp bcrypt switches WordPress's password hashes from MD5 to bcrypt, making it harder for them to be brute-forced if they are leaked.
The facts
- Rating
- 5★ from 4
- Active installs
- 200+
- Price
- Free
- Last updated
- 5 Jun 2014
- Added
- Jun 2014
- Requires WP
- 3.4
- Tested up to
- WP 3.9.40
- Downloads
- 14,486
Our analysis
AI-assistedwp-bcrypt is a WordPress plugin that enhances password security by switching the hashing algorithm from MD5 to bcrypt. Bcrypt is slower to compute, making it more difficult for attackers to crack hashed passwords through brute-force or dictionary attacks.
This plugin is suitable for users looking to improve the security of their WordPress site by using a more robust password hashing method. It requires PHP version 5.3.0 or newer to function properly.
Best for: This plugin suits WordPress users who prioritise password security.
What it does well
- ✓Switches password hashing from MD5 to bcrypt
- ✓Bcrypt is more secure against brute-force attacks
- ✓Free to use from the WordPress.org directory
- ✓Lightweight plugin with 200 active installs
Where it falls short
- •Last updated in June 2014
- •Tested only up to WordPress version 3.9.40
- •Requires PHP 5.3.0 or newer
- •May require user account resets if moved to a host without bcrypt support
Verdict
wp-bcrypt offers a straightforward way to enhance password security, but its outdated status may raise concerns for some users.
From the developer
harrym's own description of wp-bcrypt, lightly tidied.
WordPress uses phpass to store passwords. Because WordPress has to work everywere, it uses the portable version of phpass,
which uses MD5 to hash passwords. MD5 is not a very good hashing algorithm for passwords, because it’s relatively fast.
This plugin switches over to bcrypt, which is the algorithm recommended by phpass, and is a much better option for password
storage because it is much slower to produce. This makes it much harder for an attacker who’s managed to access your hashed
passwords to obtain plain text passwords by brute-forcing, or by trying passwords from a dictionary.
Note: this plugin requires PHP 5.3.0 or newer
Be aware that if you use this plugin and then move to a host that does not support bcrypt, you will need to reset any user
account that you want to log in with.