wp-includes/class-phpass.php:214$password function HashPassword($password) { if ( strlen( $password ) > 4096 ) { return '*'; } $random = ''; if (CRYPT_BLOWFISH === 1 && !$this->portable_hashes) { $random = $this->get_random_bytes(16); $hash = crypt($password, $this->gensalt_blowfish($random)); if (strlen($hash) === 60) { return $hash; } } if (strlen($random) < 6) { $random = $this->get_random_bytes(6); } $hash = $this->crypt_private($password, $this->gensalt_private($random)); if (strlen($hash) === 34) { return $hash; } # Returning '*' on error is safe here, but would _not_ be safe # in a crypt(3)-like function used _both_ for generating new # hashes and for validating passwords against existing hashes. return '*'; }Unchanged from 6.7.7 through 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
src/wp-includes/class-phpass.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.