Checks whether a plaintext message matches the hashed value. Used to verify values hashed via wp_fast_hash().
Description
The function uses Sodium to hash the message and compare it to the hashed value. If the hash is not a generic hash, the hash is treated as a phpass portable hash in order to provide backward compatibility for passwords and security keys which were hashed using phpass prior to WordPress 6.8.0.
Parameters
$messagestring
The plaintext message.
$hashstring
Hash of the message to check against.
Return
bool
Whether the message matches the hashed message.
Uses · 4
str_starts_with()Polyfill for `str_starts_with()` function added in PHP 8.0.
wp_fast_hash()Returns a cryptographically secure hash of a message using a fast generic hash function.
9386functionwp_verify_fast_hash(9387#[\SensitiveParameter]9388string$message,9389string$hash9390):bool{9391if(!str_starts_with($hash,'$generic$')){9392// Back-compat for old phpass hashes.9393require_onceABSPATH.WPINC.'/class-phpass.php';9394return(newPasswordHash(8,true))->CheckPassword($message,$hash);9395}93969397returnhash_equals($hash,wp_fast_hash($message));9398}
History
Introduced in 6.8.0. Unchanged from 6.8.8 through 7.1.0.
Signature, return type and hooks compared across 4 parsed releases.
About this page
Parsed data
Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/functions.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.