wordpress-bcrypt-hash/main.js

Check plaintext passwords against Wordpress hashes. Works for Wordpress versions 6.8 or higher.

/*******
 * Verify a wordpress password.
 * Works for Wordpress 6.8 & above.
 ******/
const crypto = require('node:crypto');
var twinBcrypt = require('twin-bcrypt')

/* WP uses a base64 encoded sha-384 pre-hash that is then hashed against bcrypt */
async function verifyPassword(plaintext, hashedText){ //Use to check that a user entered the correct password
    try{
        if(!plaintext || !hashedText || typeof plaintext !== "string" || typeof hashedText !== "string" || hashedText.length < 3 || hashedText.length > 4096){
            throw new Error("User inputs are incorrect. Make sure both inputs are typeof string.")
        }

        hashedText = hashedText.substring(3, hashedText.length) //remove $wp from start
        plaintext = crypto.createHmac('sha384', 'wp-sha384').update(plaintext).digest('base64');
      
        return (await twinBcrypt.compareSync(plaintext, hashedText))
        
    }catch(e){
        console.log(e)
        return false
    }
}

module.exports = {
    verifyPassword
}