Download the PHP package jazzman/wp-password-argon without Composer
On this page you can find all versions of the php package jazzman/wp-password-argon. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download jazzman/wp-password-argon
More information about jazzman/wp-password-argon
Files in jazzman/wp-password-argon
Package wp-password-argon
Short Description Securely store WordPress user passwords in database with Argon2i hashing and SHA-512 HMAC using PHP's native functions.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package wp-password-argon
WP Password Argon
Enhance WordPress security by replacing outdated MD5 password hashing with modern Argon2i encryption
The Problem
WordPress still uses MD5-based password hashing (via PHPass), an algorithm from 2001 that's considered weak by modern security standards. While adequate for its time, MD5 is vulnerable to:
- ⚠️ Brute force attacks (fast to compute)
- ⚠️ Rainbow table attacks
- ⚠️ GPU-accelerated cracking
The Solution
This must-use plugin replaces WordPress's password hashing system with:
- ✅ Argon2i - Winner of Password Hashing Competition (2015)
- ✅ SHA-512 HMAC - Additional layer of protection
- ✅ Automatic migration - Rehashes old passwords on login
- ✅ Zero configuration - Drop in and forget
- ✅ Backward compatible - Works with existing WordPress user system
Key Features
🔐 Modern Cryptography
- Argon2i algorithm - Memory-hard hashing designed to resist GPU attacks
- SHA-512 HMAC - Adds salt-based message authentication
- Native PHP functions - No external dependencies, uses PHP's
password_hash()
🔄 Seamless Migration
- Automatically detects old MD5 hashes
- Rehashes passwords when users login
- No manual migration needed
- Maintains backward compatibility during transition
🎯 Drop-in Replacement
- Overrides core WordPress functions:
wp_hash_password(),wp_check_password(),wp_set_password() - Works as must-use plugin (loads before regular plugins)
- Supports Application Passwords (WordPress 5.6+)
- No configuration required
⚡ Performance
- Minimal overhead compared to MD5
- Argon2i parameters can be customized via filter
- Efficient rehashing on authentication
Installation
Via Composer (Recommended)
The package installs automatically to wp-content/mu-plugins/wp-password-argon/ via Composer Installers.
Manual Installation
- Download the latest release
- Upload to
wp-content/mu-plugins/wp-password-argon/ - That's it! No activation needed (must-use plugins auto-load)
How It Works
Password Hashing Flow
Authentication Flow
Configuration
The plugin works out-of-the-box with secure defaults. To customize Argon2i parameters:
Security Benefits
| Aspect | MD5 (WordPress default) | Argon2i (This plugin) |
|---|---|---|
| Algorithm Age | 1992 (33 years old) | 2015 (10 years old, current best practice) |
| Cracking Speed | Very fast | Slow (memory-hard) |
| GPU Resistance | ❌ Weak | ✅ Strong |
| Rainbow Tables | ❌ Vulnerable | ✅ Resistant |
| OWASP Recommended | ❌ No | ✅ Yes |
Requirements
- PHP: 7.4+ or 8.1+ (PHP 8+ recommended)
- WordPress: 5.2+
- PHP Extensions:
sodium(usually bundled with PHP 7.2+)- No additional extensions needed
Under The Hood
Quality Tooling
This package maintains high code quality standards:
Tech Stack
- Static Analysis: PHPStan (max level), Psalm
- Code Style: PHP CS Fixer with custom rules (
jazzman/php-cs-fixer-rules) - Security Auditing: Roave Security Advisories
- Type Safety: WordPress stubs for IDE support
Package Configuration
- Type:
wordpress-muplugin(auto-installs to mu-plugins) - License: MIT
- Optimizations: APCu autoloader, optimized autoloader, authoritative classmap
FAQ
Q: Will this break my existing WordPress site?
A: No. The plugin is backward compatible. Old passwords work during the transition period and are automatically upgraded on user login.
Q: What happens if I remove the plugin?
A: Users with Argon2i passwords won't be able to login. Recommendation: Keep the plugin installed once deployed.
Q: Does this work with multisite?
A: Yes. Install as network-wide must-use plugin.
Q: Performance impact?
A: Minimal. Argon2i is slightly slower than MD5, but this is intentional (security vs. speed trade-off). Typical impact: <100ms per authentication.
Q: Can I migrate back to MD5?
A: Technically possible but strongly discouraged for security reasons. Once passwords are hashed with Argon2i, they should stay that way.
Why This Matters
Real-world impact:
- WordPress powers 43% of the web
- Over 455 million websites use WordPress
- Default MD5 hashing leaves millions of sites vulnerable
- This plugin provides enterprise-grade security with zero effort
Recommended by:
- ✅ OWASP (Open Web Application Security Project)
- ✅ NIST (National Institute of Standards and Technology)
- ✅ PHP Security Best Practices
Related Packages
Part of the jazzman WordPress ecosystem:
jazzman/wp-performance- Performance & security optimizationsjazzman/wp-object-cache- PSR-16 object cachingjazzman/wp-nav-menu-cache- Navigation menu caching
License
MIT License - see LICENSE file for details.
Author
Vasyl Sokolyk
Support & Contributing
Found a bug? Have a feature request? Open an issue on GitHub.
Security vulnerabilities: Please email [email protected] directly rather than opening a public issue.
⭐ If this plugin improved your WordPress security, please star the repo!
