Is it possible to display newly generated password after wp_generate_password()?

By default when a users submits a password reset from wp-login.php, reset_password is called. In user.php, reset_password() triggers the password_reset hook where you can see the plain text version before it is set. And the same for after_password_reset.

add_action( 'password_reset', 'my_password_reset', 10, 2 );

function my_password_reset( $user, $new_pass ) {
    // Do something before password reset.
}

wp_set_password() immediately runs wp_hash_password() and is entered into the database as encrypted text. The hooks above are the last time you can see the plain text version of the password.

function wp_hash_password($password) {
    global $wp_hasher;

    if ( empty($wp_hasher) ) {
        require_once( ABSPATH . WPINC . '/class-phpass.php');
        // By default, use the portable hash from phpass
        $wp_hasher = new PasswordHash(8, true);
    }

    return $wp_hasher->HashPassword( trim( $password ) );
}

When the operation is complete, the login_header is set to ‘Your password has been reset.’.

As you can see, using wp_get_current_user() or get_user_by() will only show you the encrypted version later on.

$user = wp_get_current_user();
echo $user->data->user_pass;

$user = get_user_by ('id', 1 );
echo $user->data->user_pass;

If you want to write a custom function using wp_generate_password() then its up to you to do it in a way that shows the plain text version to the user, much like wp-login.php does.

Related Posts: