I've been trying to find a version of which WordPress stopped using MD5 and started using the Portable PHP password hashing framework. I've been trying to search for a while and found nothing, the closest thing I can find is "WordPress used to use MD5" but I can't pinpoint a version.

If anyone can remember, it would be greatly appreciated.

1 Answer 1


The easiest way to find these things is often to check the source.

If you go to the GitHub repo and search for the password hashing implementation you'll find it in wp-includes/pluggable.php. Then it's just a matter of looking back through history to find the commit that made the change. The oldest version that commit is tagged with is 2.5.

This is further confirmed by checking the release notes for that version:

Salted passwords — we now use the phpass library to stretch and salt all passwords stored in the database, which makes brute-forcing them impractical.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .