About WordPress Password Hashing

WordPress uses a secure hashing algorithm to store passwords in its database. Since version 3.0, WordPress has used the Portable PHP password hashing framework (PHPass) to create hashes using the Blowfish algorithm (CRYPT_BLOWFISH) when available, falling back to MD5-based hashing if necessary.

WordPress password hashes are formatted with a prefix indicating the hashing algorithm used, followed by the cost factor and the salt used during hashing. The resulting hash is 60 characters long and includes the algorithm, cost, salt, and the hashed password itself.