Add support for WordPress 6.8+ bcrypt password hashes ($wp$2y$)

[francoataffarel]

Description

WordPress 6.8 introduced a new password hashing format based on bcrypt with an HMAC-SHA384 pre-hashing step.

The resulting hashes use the $wp$2y$ prefix.

It would be useful for John the Ripper to support this format natively, including automatic hash detection and a dedicated format name such as wpbcrypt.

Algorithm

The password transformation performed by WordPress is:

digest = HMAC-SHA384(
    key = "wp-sha384",
    message = password
)

encoded = base64_encode(digest)

hash = bcrypt(encoded, salt, cost)

The stored bcrypt hash is then prefixed with $wp$:

$wp$2y$<cost>$<salt-and-digest>

Conceptually:

bcrypt(base64(HMAC-SHA384(key="wp-sha384", password)))

Test vector

Example hash:

$wp$2y$10$607XKVrBjPEqujeOXNwbYuOJ.gPMd2TelMMknmeV70Kap1E81Ovo6

Expected plaintext:

hashpwn

Expected usage could be similar to:

john --format=wpbcrypt hashes.txt

or through automatic format detection:

john hashes.txt

Compatibility reference

Hashcat added native support for this algorithm as mode 35500.

Example:

echo hashpwn | hashcat -m 35500 -a 0 --potfile-disable \
'$wp$2y$10$607XKVrBjPEqujeOXNwbYuOJ.gPMd2TelMMknmeV70Kap1E81Ovo6'

References

• WordPress announcement:
  https://make.wordpress.org/core/2025/02/17/wordpress-6-8-will-use-bcrypt-for-password-hashing/

• WordPress implementation:
  https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/class-wp-password-hash.php

• Hashcat implementation:
  Add Wordpress bcrypt hashcat/hashcat#4512

• Hash generation implementation:
  https://github.com/cyclone-github/hashgen

Suggested requirements

• Recognize hashes beginning with $wp$2y$.
• Remove the WordPress-specific $wp$ marker before processing the bcrypt portion.
• Apply HMAC-SHA384 using the fixed key wp-sha384.
• Base64-encode the binary HMAC digest using standard Base64.
• Use the resulting Base64 string as the bcrypt password input.
• Support the bcrypt cost contained in the stored hash.
• Include test vectors for ASCII and UTF-8 passwords.
• Provide CPU support initially, with OpenCL support considered separately.

Thank you for maintaining John the Ripper.