This is actually incorrect. It's using Phpass by Solar Designer, which is not the same thing as merely "using MD5". Typically, I reserve that choice of words f

This is actually incorrect. It's using Phpass by Solar Designer, which is not the same thing as merely "using MD5". Typically, I reserve that choice of words for constructions like this: $hash = md5($password); $hash = md5($password . $salt); // etc This MD5 code is still bad. They really should migrate to just using password_hash() and password_verify(), but they won't. They're committed to supporting PHP 5.2.x forever (or at least until every shared host in existence stops supporting 5.2, which is effectively forever). https://github.com/WordPress/WordPress/blob/6edbcc88ff5ba0acaba8a8e1d2490ed64ff33b63/wp-includes/class-phpass.php#L225-L239 https://github.com/WordPress/WordPress/blob/6edbcc88ff5ba0ac... Note that, on newer versions of PHP, bcrypt will be used instead of the method linked by this HN submission.