Check the password of a user

3 comments

1. Your example works correctly. You are checking if password hello matches hashed hello – which it naturally does.

   Hadn’t thought it through. Your example causes following issue:

   1. You check if hello matches md5 of hello (instead of hash from user’s profile).
   2. It does and then WP thinks this is correct, but outdated md5 hash – that must be updated.
   3. It re-hashes hello and updates user with it, locking him out (since his password is now hello instead of whatever it was before).

   See wp_authenticate_username_password() function for extensive example, but basic idea is:

   $userdata = get_user_by('login', $username);
   $result = wp_check_password($password, $userdata->user_pass, $userdata->ID);
   

   Log in to Reply

2. You can grab their hashed password from the database, and compare it to the entry you want to check using wp_hash_password().

   To check if the current user’s password matches “hello”, try this:

   if ( $current_user->user_pass == wp_hash_password( 'hello' ) )
   

   Log in to Reply

3. require_once ABSPATH . WPINC . '/class-phpass.php';
   $wp_hasher = new PasswordHash(8, TRUE);
   
   $password_hashed = '$P$BB3pP6fQAYa61ael0LNQlpB1NOyqNY0';
   $plain_password = 'admin2';
   if($wp_hasher->CheckPassword($plain_password, $password_hashed)) {
       print 'Password matched.';
   }
   

   Credits to: https://stackoverflow.com/a/37181662

   Log in to Reply