# wp_hash_password()

URL: https://chugunov.pro/api-wordpress/functions/wp_hash_password/
Проверено на WordPress 6.9, обновлено 06.08.2026.
Источник: независимый русскоязычный справочник chugunov.pro. Не является официальной документацией WordPress.

Тип: функция.
Появился в версии: 2.5.0.

## Сигнатура

```php
wp_hash_password( string $password ): string
```

## Описание

Для интеграции с другими приложениями эту функцию можно переопределить, чтобы вместо этого использовать алгоритм хеширования паролей другого пакета.

## Параметры

- `$password` `string` — обязательный. Пароль пользователя в открытом виде для хеширования.

## Возвращаемое значение

`string`

## Исходный код

Файл: `wp-includes/pluggable.php:2749`

```php
function wp_hash_password(
	#[\SensitiveParameter]
	$password
) {
	global $wp_hasher;

	if ( ! empty( $wp_hasher ) ) {
		return $wp_hasher->HashPassword( trim( $password ) );
	}

	if ( strlen( $password ) > 4096 ) {
		return '*';
	}

	/**
	 * Filters the hashing algorithm to use in the password_hash() and password_needs_rehash() functions.
	 *
	 * The default is the value of the `PASSWORD_BCRYPT` constant which means bcrypt is used.
	 *
	 * **Important:** The only password hashing algorithm that is guaranteed to be available across PHP
	 * installations is bcrypt. If you use any other algorithm you must make sure that it is available on
	 * the server. The `password_algos()` function can be used to check which hashing algorithms are available.
	 *
	 * The hashing options can be controlled via the 'wp_hash_password_options' filter.
	 *
	 * Other available constants include:
	 *
	 * - `PASSWORD_ARGON2I`
	 * - `PASSWORD_ARGON2ID`
	 * - `PASSWORD_DEFAULT`
	 *
	 * @since 6.8.0
	 * @since 7.0.0 The `$algorithm` parameter is now always a string.
	 *
	 * @param string $algorithm The hashing algorithm. Default is the value of the `PASSWORD_BCRYPT` constant.
	 */
	$algorithm = apply_filters( 'wp_hash_password_algorithm', PASSWORD_BCRYPT );

	/**
	 * Filters the options passed to the password_hash() and password_needs_rehash() functions.
	 *
	 * The default hashing algorithm is bcrypt, but this can be changed via the 'wp_hash_password_algorithm'
	 * filter. You must ensure that the options are appropriate for the algorithm in use.
	 *
	 * @since 6.8.0
	 * @since 7.0.0 The `$algorithm` parameter is now always a string.
	 *
	 * @param array  $options   Array of options to pass to the password hashing functions.
	 *                          By default this is an empty array which means the default
	 *                          options will be used.
	 * @param string $algorithm The hashing algorithm in use.
	 */
	$options = apply_filters( 'wp_hash_password_options', array(), $algorithm );

	// Algorithms other than bcrypt don't need to use pre-hashing.
	if ( PASSWORD_BCRYPT !== $algorithm ) {
		return password_hash( $password, $algorithm, $options );
	}

	// Use SHA-384 to retain entropy from a password that's longer than 72 bytes, and a `wp-sha384` key for domain separation.
	$password_to_hash = base64_encode( hash_hmac( 'sha384', trim( $password ), 'wp-sha384', true ) );

	// Add a prefix to facilitate distinguishing vanilla bcrypt hashes.
	return '$wp' . password_hash( $password_to_hash, $algorithm, $options );
}
```

## История изменений

- 6.8.0 — The password is now hashed using bcrypt by default instead of phpass.
- 2.5.0 — Introduced.

## Связанные

Использует: [`apply_filters`](https://chugunov.pro/api-wordpress/functions/apply_filters/).
Используется в: [`wp_set_password`](https://chugunov.pro/api-wordpress/functions/wp_set_password/), [`wp_update_user`](https://chugunov.pro/api-wordpress/functions/wp_update_user/), [`wp_insert_user`](https://chugunov.pro/api-wordpress/functions/wp_insert_user/).

Оригинал в официальной документации: https://developer.wordpress.org/reference/functions/wp_hash_password/