Skip to content
A leet hacker bypasses security. Probably.

WordPress forgotten password localhost hack

Thursday, June 10, 2021

At 355 words, this article should take about 2 minutes to read.

I have lost count of the number of times I've forgotten the password to the local or development CMS.

My natural instinct is to click the Forgot Password link but, obviously, there's no way to trigger that email from the local system.

I've spent too long hunting through articles on how to recover the forgotten password. The quickest and easiest solution that I've found is to change the password manually in the database.

How do we do that then?

WordPress stores passwords in the wp_users table. The prefix may be different if you have elected to change that in the wp-config.php file. It's good practice to do that for security.

When you look at the table, it'll look a little like this…

ID user_login user_pass
1 thomasxbanks $P$BHpcLw/aWsTPmeDprzXwOEl45bJm9A3

WordPress stores your password as an MD5 hashed string. This prevents anyone with access to the database seeing confidential information in plain text.

WordPress salts the password using PHPass (as you can see from the $P$ at the start of the example password). This hack will still work though as, even if your password has been salted, you can still replace the password with an MD5 hash, and WordPress will let you log in.

If this wasn't obfuscated like this, we'd be able to copy our password and paste it into the login form…but we can't - and for good reason!

So, to fix our little problem, we need to replace the existing hashed password with a new hashed password - we can't overwrite the MD5 hash with plain text because that won't work.

I have Hasher installed as a plugin in VS Code. If you don't use VS Code or don't want to use this extension, MD5 Hash Generator Online works pretty well.

I would recommend that you don't create your "forever password" using these hash generators though. Overwrite the existing password with something easy to remember and very, very temporary - a favourite of mine is Pa55word!

267057150e34eca5c6af39ec9b30864e

Once the password has been changed, you can log in with your new password and immediately change it to something more secure.

I hope this helps you as much as it has helped me. 😎

Cover image courtesy of Clint Patterson.

Comments

In almost all cases, the comments section is a cesspool of Reply Guys, racists, and bots.

I don't want to have to deal with that kind of hell so I don't have a comments section.

If you want to continue the conversation, you can always hit me up on Twitter (which is, in it's own way, a vile cesspool of Reply Guys, racists, and bots).

Thomas Banks

Thomas Banks

When I'm not building things for the internet, I take photos of stuff.
Loading Invisible Visible Navigation Close Arrow Info Online Online