As of Wordpress 6.8+, Wordpress user passwords are now hashed using Bcrypt instead of MD5. More specifically, Wordpress performs the hash on a base64-encoded SHA-384 hash of the password.

This is a simple package for verifying a plaintext password to a Bcrypt wordpress hash. It will not work for Wordpress versions older than 6.8.

Use the verifyPassword(plaintext, hashedText) function to verify is a plaintext password is correct. It takes two strings- the first being the plaintext password, & the second being the Wordpress hash from the Wordpress Database.

Example:

var wp = require('wordpress-bcrypt-hash')
async function validateUser(plaintext){

    // Get hashed password from Wordpress database

    const isPasswordCorrect = await wp.verifyPassword(plaintext, hashedText)
    
    if(isPasswordCorrect){
        // Password is correct & user is authenticated
    }
    else{
        // User is not authenticated
    }
}