WP Manifestindependent plugin directory
manifest / security / wp-password-argon

WP Password Argon

Securely store WordPress user passwords in database with Argon2i hashing and SHA-512 HMAC using PHP's native functions.

by Vasyl Sokolyk · github.com/jazz-man/wp-password-argon · website

0stars
0forks

Install

No release zip yet. The repository archive installs, but the folder name will carry the branch suffix and updates will not flow:

wp plugin install https://github.com/jazz-man/wp-password-argon/archive/refs/heads/master.zip

Declares an update source (https://github.com/Jazz-Man/wp-password-argon.), so updates arrive through the plugin's own updater.

From the readme

WP Password Argon Enhance WordPress security by replacing outdated MD5 password hashing with modern Argon2i encryption The Problem WordPress still uses MD5-based password hashing (via PHPass), an algorithm from 2001 that's considered weak by modern security standards. While adequate for its time, MD5 is vulnerable to: - ⚠️ Brute force attacks (fast to compute) - ⚠️ Rainbow table attacks - ⚠️ GPU-accelerated cracking The Solution This must-use plugin replaces WordPress's password hashing system with: - ✅ Argon2i - Winner of Password Hashing Competition (2015) - ✅ SHA-512 HMAC - Additional layer of protection - ✅ Automatic migration - Rehashes old passwords on login - ✅ Zero configuration - Drop in and forget - ✅ Backward compatible - Works with existing WordPress user system Key Features 🔐 Modern Cryptography - Argon2i algorithm - Memory-hard hashing designed to resist GPU attacks - SHA-512 HMAC - Adds salt-based message authentication - Native PHP functions - No external dependencies, uses PHP's passwordhash() 🔄 Seamless Migration - Automatically detects old MD5 hashes - Rehashes passwords when users login - No manual migration needed - Maintains backward compatibility d

Read the full README on GitHub →

Releases

TagPublished
0.2.0 Oct 23, 2025
0.1.0 Oct 30, 2022

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.