JPKCom DB
View on GitHub (opens in a new tab)

JPKCom Enable Argon2 — Guide & Tips

How to switch WordPress password hashes to Argon2id with JPKCom Enable Argon2 — installation, requirements and practical migration tips.

JPKCom Enable Argon2 switches your WordPress password hashes to Argon2id — the memory- and compute-hard winner of the Password Hashing Competition. Useful when you want to go beyond the bcrypt default that WordPress ships since 6.8.

Guide

Requirements

  • WordPress 6.9 or newer (tested up to WordPress 7.1)
  • PHP 8.3 or newer with Argon2id support (PASSWORD_ARGON2ID)
  • Multisite is supported (the plugin is network-enabled)

Installation

  1. In your admin panel, go to Plugins → Add New and click Upload Plugin.
  2. Choose the plugin's ZIP file and click Install Now.
  3. Click Activate.

There is no settings page — once active, the plugin takes effect automatically.

How it works

Since WordPress 6.8 the core uses bcrypt for password hashes by default (previously phpass). This plugin enables Argon2id instead. Argon2id is designed to be memory-hard, which makes GPU-based brute-force attacks considerably harder. For background on the core change, see the WordPress core post on password hashing (opens in a new tab).

Tips & Tricks

  • Existing hashes migrate gradually: WordPress only rehashes a password on the user's next successful login. The switch to Argon2id therefore happens over time — no mass reset required. For sensitive accounts you can force a password reset so the new algorithm applies immediately.
  • Check Argon2id support: Make sure your PHP environment knows Argon2id (the PASSWORD_ARGON2ID constant is present). Otherwise the algorithm is unavailable.
  • Only one plugin should own hashing: If another security plugin also touches password hashing, clarify responsibilities — otherwise the methods override each other.
  • Reproducible updates: Since version 2.0.2 the plugin uses secure self-hosted updates via GitHub with SHA256 checksums and runs with declare(strict_types=1). Since 2.0.9 it also carries the Update URI header: the wordpress.org update API then no longer returns updates for this plugin, so a plugin published there under the same slug cannot pose as an update. Since 2.0.10 Dashboard → Updates shows the JPKCom logo next to the plugin.
  • Updates even while deactivated: Since 2.0.11 (updater 1.5.0) the plugin is offered updates even when it is deactivated — provided another JPKCom plugin with updater 1.5.0 or newer is active. Its updater answers the update check for all installed JPKCom plugins, with the update row, icon and “View details”, and the SHA256 check applies exactly as for an active plugin. On multisite at least one JPKCom plugin must be network-active or active on the main site. Also since 2.0.11: the stored update list no longer contains JPKCom download URLs, a JPKCom updater adds them back only while it is loaded; the checksum is also verified for a package supplied by another plugin, and for every GitHub address of the release file. If the plugin sits in a Git or other VCS checkout, or (while active) in a renamed folder, you are told about a new release, but WordPress never updates it automatically — the update would delete the checkout or the folder. A deactivated plugin in a renamed folder is not recognised by the updater at all. The updater fetches update information only for users who can update plugins, in the update cron and in WP-CLI, never for anonymous visitors.

Further reading