wp-bcrypt
wp bcrypt switches WordPress's password hashes from MD5 to bcrypt, making it harder for them to be brute-forced if they are leaked.
5(4 reviews)
·300 active installs·Updated 11 years agoAs of April 2026, wp-bcrypt is a WordPress security plugin with 300 active installations and a 5/5 rating from 4 reviews. It has been downloaded 13K+ times in total. Requires WordPress 3.4+ and PHP false+. Available on WordPress.org since 2014. Last updated 11 years ago — may have compatibility concerns. Top alternative: Wordfence Security – Firewall, Malware….
5/54 reviews
300active installs
13K+total downloads
12 yearssince 2014
Overview
WordPress uses phpass to store passwords. Because WordPress has to work everywere, it uses the portable version of phpass,
which uses MD5 to hash passwords. MD5 is not a very good hashing algorithm for passwords, because it’s relatively fast.
This plugin switches over to bcrypt, which is the algorithm recommended by phpass, and is a much better option for password
storage because it is much slower to produce. This makes it much harder for an attacker who’s managed to access your hashed
passwords to obtain plain text passwords by brute-forcing, or by trying passwords from a dictionary.
Note: this plugin requires PHP 5.3.0 or newer
Be aware that if you use this plugin and then move to a host that does not support bcrypt, you will need to reset any user
account that you want to l…
Ratings & Reviews
54 reviews
5 ★
4
4 ★
0
3 ★
0
2 ★
0
1 ★
0
Compatibility
| WordPress | 3.4+ requiredTested up to 3.9.40 |
| PHP | false+ required |
Top Alternatives to wp-bcrypt
Frequently Asked Questions
Changelog
1.0.1
- Readme improvements
Contributors
Plugin data sourced from WordPress.org. Analysis and metrics by PluginSift.