WP Password Argon
Securely store WordPress user passwords in database with Argon2i hashing and SHA-512 HMAC using PHP's native functions.
by Vasyl Sokolyk · github.com/jazz-man/wp-password-argon · website
★ 0stars
0forks
Install
No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:
wp plugin install https://github.com/jazz-man/wp-password-argon/archive/refs/heads/master.zipDeclares an update source (https://github.com/Jazz-Man/wp-password-argon.), so updates arrive through the plugin's own updater.
From the readme
WP Password Argon
Enhance WordPress security by replacing outdated MD5 password hashing with modern Argon2i encryption
The Problem
WordPress still uses MD5-based password hashing (via PHPass), an algorithm from 2001 that's considered weak by modern security standards. While adequate for its time, MD5 is vulnerable to:
- ⚠️ Brute force attacks (fast to compute)
- ⚠️ Rainbow table attacks
- ⚠️ GPU-accelerated cracking
The Solution
This must-use plugin replaces WordPress's password hashing system with:
- ✅ Argon2i - Winner of Password Hashing Competition (2015)
- ✅ SHA-512 HMAC - Additional layer of protection
- ✅ Automatic migration - Rehashes old passwords on login
- ✅ Zero configuration - Drop in and forget
- ✅ Backward compatible - Works with existing WordPress user system
Key Features
🔐 Modern Cryptography
- Argon2i algorithm - Memory-hard hashing designed to resist GPU attacks
- SHA-512 HMAC - Adds salt-based message authentication
- Native PHP functions - No external dependencies, uses PHP's passwordhash()
🔄 Seamless Migration
- Automatically detects old MD5 hashes
- Rehashes passwords when users login
- No manual migration needed
- Maintains backward compatibility d
Read the full README on GitHub →
Releases
These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.