Better Passwords

Description

This plugin sets a default minimum password length of 10 characters, to ensure that passwords are suitably long that they are hard to guess. However, it does not insist on any complexity rules, such as digits and special characters, as length is the most important thing when making a password hard to guess.

This plugin uses Troy Hunt’s Pwned Passwords API in order to check a user’s potential password against a corpus of breached passwords.

The password itself is never sent to any third party, only a partial hash is sent. This means that the password entered will always be private.

As an added bonus, this plugin also upgrades the hashing algorithm used when storing your password in the database. This is a secure one-way hash created using the Bcrypt or Argon2 algorithm.

Reviews

September 28, 2024
Perfect for my needs, as it doesn’t attempt to enforce overly complex password rules, it just allows me to set a minimum length, and checks new passwords against Have I Been Pwned to make sure it’s not been previously included in a breach. Can also store passwords using stronger hashing algorithms than the WordPress default.
November 15, 2020 1 reply
I like this plugin because it is simple in its design, easy to use, and strong in its password protection. I highly recommend it. Cybersecurity is a fast moving domain, and this plugin smartly used a standards-based approach that makes it easy to keep your website password security to the latest levels of available protection.
July 28, 2019
I use this plugin on all of my sites – it not only checks if a used password is included in a haveibeenpwned.com leak, but also forces Wordpress to use more secure hashing algorithms for saving passwords. Highly recommended!
Read all 3 reviews

Contributors & Developers

“Better Passwords” is open source software. The following people have contributed to this plugin.

Contributors

Translate “Better Passwords” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.