wppaste
WordPress

apply_filters( 'wp_hash_password_algorithm', string $algorithm )

Since
6.8.0, 7.0.0
Filters the hashing algorithm to use in the password_hash() and password_needs_rehash() functions.

Description

The default is the value of the PASSWORD_BCRYPT constant which means bcrypt is used.

Important: The only password hashing algorithm that is guaranteed to be available across PHP installations is bcrypt. If you use any other algorithm you must make sure that it is available on the server. The password_algos() function can be used to check which hashing algorithms are available.

The hashing options can be controlled via the 'wp_hash_password_options' filter.

Other available constants include:

  • PASSWORD_ARGON2I
  • PASSWORD_ARGON2ID
  • PASSWORD_DEFAULT

Compatibility

WordPress
since 7.0.0
  • 6.7.7
  • 6.8.8
  • 6.9.7
  • 7.0.4
  • 7.1.0

Present in 4 of the 5 tracked releases, added in 7.0.0.

Parameters

$algorithmstring
The hashing algorithm. Default is the value of the PASSWORD_BCRYPT constant.

Where this hook fires · 2

  • wp-includes/pluggable.php:2789wp_hash_password()
  • wp-includes/pluggable.php:2919wp_password_needs_rehash()

Source code

View on Trac View on GitHub 

		 *		 * @since 6.8.0		 * @since 7.0.0 The `$algorithm` parameter is now always a string.		 *		 * @param string $algorithm The hashing algorithm. Default is the value of the `PASSWORD_BCRYPT` constant.		 */		$algorithm = apply_filters( 'wp_hash_password_algorithm', PASSWORD_BCRYPT ); 		/**		 * Filters the options passed to the password_hash() and password_needs_rehash() functions.		 *		 * The default hashing algorithm is bcrypt, but this can be changed via the {@see 'wp_hash_password_algorithm'}		 * filter. You must ensure that the options are appropriate for the algorithm in use.

Changelog

Introduced in 6.8.0. 2 changes between 6.8.8 and 7.1.0.

  1. 6.8.8
  2. 6.9.7
  3. 7.0.4
  4. 7.1.0

Signature, return type and hooks compared across 4 parsed releases.

7.0.4
Parameter $algorithm retyped from string|int to string.verified against source
7.0.0
The $algorithm parameter is now always a string.from the docblock
6.9.7
Parameter $algorithm retyped from string to string|int.verified against source
6.8.0
Introduced.from the docblock

About this page

Parsed data
Generated from the wordpress-develop 7.1.0 tag, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.
Corrections
Something wrong on this page? Report it and it gets fixed in the next regeneration.