wp-bcrypt
wp bcrypt switches WordPress's password hashes from MD5 to bcrypt, making it harder for them to be brute-forced if they are leaked.
Overview
Compatibility
Installation instructions
Customer support & learning resources
Changelog
Main benefits
Switches to bcrypt
Improves password security
Slows down brute-force attacks
Requires PHP 5.3.0+
Overview
This WordPress plugin enhances the security of password storage by replacing the default MD5 hashing algorithm with bcrypt. MD5 is considered less secure due to its faster processing speed, which makes it easier for attackers to brute-force or use dictionaries to crack passwords. By switching to bcrypt, which is much slower to produce, the plugin significantly bolsters password security, making it substantially harder for attackers to reverse-engineer hashed passwords. It's important to note that the plugin requires PHP version 5.3.0 or newer. However, users should be cautious, as moving to a host that does not support bcrypt will necessitate resetting any user accounts intended for login access.
Enhanced Security
- Switches from MD5 to bcrypt for password hashing.
- Bcrypt is slower to produce, making brute-force attacks more difficult.
Recommended Algorithm
- Uses bcrypt, the algorithm recommended by phpass.
- Bcrypt is considered a better option for password storage.
Improved Password Protection
- Harder for attackers to obtain plain text passwords.
- More resistant to dictionary attacks.
Compatibility Note
- Requires PHP 5.3.0 or newer.
- Users need to reset accounts if moving to a host that does not support bcrypt.
Rating and reviews
momosampaii
02 Dec, 2017
Is it work with wordpress 4.9?
Thanks
evan-beakerstudio
15 Jun, 2015
Just installed this, logged out and back into WordPress, and MySQL shows that my password is now in bcrypt format. Many thanks to the author, because this small change makes user logins significantly less vulnerable to brute force attempts!
Dan Maby
30 Jul, 2014
I used this plugin in combination with the Auth0 – Single Sign On with Social, Enterprise and User/Passwords plugin and I’ve been able to build a central authentication system that is using the WP database at it’s core and I’m now able to offer SSO across multiple instances of WP as well as our asp.net applications!
This would not have been possible had it not of been for this great plugin, it just simply works brilliantly.
mojorob
24 Jun, 2014
Does exactly as it says, nice and simple!
I run a number of WP sites, currently v3.9.1 on PHP 5.5, and this plugin for switching password hashes to bcrypt runs great.
