What’s the algorithm to verify user password?

First: Be aware that this is pluggable in WP so first of all check that you’re site is using the default implementation.

Then have a look at wp_hash_password and wp_check_password in pluggable.php and the PasswordHash class. There you should find what you are looking for.

Related Posts:

  1. How to change user password with wp-cli?
  2. wordpress redirect after password reset
  3. Loosen/disable password policy
  4. Password Protect Custom Page
  5. How can I change the default wordpress password hashing system to something custom?
  6. If I change the salt keys in my wp-config will all passwords break?
  7. Conditional to test if post has password protection enabled
  8. Bypass password protected posts via GET variable
  9. Check the password of a user
  10. How to add Wp_error using lostpassword_post hook when validating custom field?
  11. Create a USERNAME and PASSWORD protected WordPress page
  12. Why do generated passwords start/end with spaces?
  13. Safe to store SMTP password in wp-config.php?
  14. Reseting admin password through PHPMyadmin fails
  15. Check Password Reset Key Not Woking
  16. Reset password – set minimum length for new password
  17. How to shorten length of auto generated password sent during registration?
  18. Forgot password not working
  19. wp_hash_password unexpected behaviour
  20. Password reset message – change the network_home_url( ‘/’ )
  21. Redirect a password protected page?
  22. Lost password link is redirecting to /shop/my-account/lost-password/
  23. WordPress: force users to change password on first login
  24. Can’t login to wordpress despite changing password to something known directly in MySQL or using “Password Reset by Email” feature
  25. Change default recovery link expiration time
  26. Password protect custom template
  27. Set content type to HTML for lost password email only
  28. Custom password generator for users
  29. Password protecting template, secured content not showing if even password is right
  30. How validate usernames/passwords against WP’s database?
  31. Make post password required to publish
  32. WordPress reset password returns invalid key
  33. Password reset bug? – “Sorry, that key does not appear to be valid”
  34. How to set minimum length and error message for password recovery?
  35. Why is resetting the WordPress Users password not working?
  36. How Authentication in wordpress works? wp_authenticate_username_password()
  37. Password Protected page not asking for a password
  38. Password protection for page template
  39. Custom login form for front-end user as well as admin
  40. Password changed [duplicate]
  41. Enable Update button only when password is shown strong
  42. How to get user password before being encrypted outside the wordpress core once add a new user from dashboard?
  43. Adding parameters to password reset key
  44. wp_hash_password create a different hash everytime
  45. Custom password form allows unlock two posts with the same password
  46. How to change password
  47. Generating the password reset link automatically
  48. Password protect pages – allow more than one password
  49. Like to store multiple passwords in db table wp_posts field post_password?
  50. Send password to user instead of reset password link
  51. Custom form for password protected page
  52. How to check user’s password?
  53. How to change “Reset Password” text on submit button
  54. Customize retrieve password message
  55. How to recover password from a user
  56. WordPress admin creation through phpmyadmin not working
  57. Can’t alter $lostpassword_url
  58. current user’s password check
  59. How to initiate password reset flow by code
  60. Change password fields
  61. lostpassword_redirect filter is not used
  62. Ask logged in user to re-enter password to access page “x”
  63. Password Protect or IP to access under development WordPress site otherwise shown a placeholder page
  64. Password-protected page redirecting to frontpage when I enter the password
  65. 2 accounts under same email preventing me from loging in
  66. wordpress custom password change problem
  67. Allow all reset password links within the past 24 hours to be valid and accepted
  68. Set id and password for each post
  69. I have to reset the admin password each time
  70. Create Member who can’t be changed
  71. Automatically change the page password for more than one page
  72. Sending Reset Password email via Web API
  73. I can’t recover my password
  74. $expiration_duration = apply_filters( ‘password_reset_expiration’, DAY_IN_SECONDS );
  75. Cannot get function.php code to work to remove Lost Password link on live site
  76. Entering a WP site with a SMS code
  77. Problem with login / reset password links in users emails
  78. How to set password from frontend if have activation key and user login in url in wordpress?
  79. Lost Password redirect to My Account
  80. Multiple pages protected by different passwords. Possible to track multiple passwords at a time?
  81. How do I display the password field on the WordPress user registration screen?
  82. Not able to log for the first time on a salted WordPress by creating pwd on BD
  83. Custom page password recovery
  84. Password Protected Logout Button Not Working
  85. Can I use core passworded page/post functions outside of wp-login.php?
  86. Is it possible to display newly generated password after wp_generate_password()?
  87. Password protect wp-login.php
  88. How do I password protect a page of posts on WordPress?
  89. Revise my keyword but still cannot login
  90. WordPress not taking password and username
  91. Is it possible to have users register without having a password?
  92. Password Protection for posts and pages [duplicate]
  93. How WordPress hashes passwords
  94. Reset Password – change from name and email address. It stucks at admin. Want to change it to info
  95. WordPress reset password button not working
  96. check if post is set to “password protected”
  97. Why can’t I create an Application Password?
  98. FTP Password (not private key-value pair) for EC2 Instance
  99. How to Disable Pre-population of Password on Password Reset
  100. My WordPress password for admin account is changing automatically