Title: Passwords in 4.3: Strong by Default Author: Mark Jaquith Published: July 28, 2015 Last modified: August 25, 2015 --- [ ](https://profiles.wordpress.org/markjaquith/) [Mark Jaquith](https://profiles.wordpress.org/markjaquith/) 11:54 pm _on_ July 28, 2015 Tags: [4.3 ( 65 )](https://make.wordpress.org/core/tag/4-3/), [dev-notes ( 648 )](https://make.wordpress.org/core/tag/dev-notes/), [passwords ( 3 )](https://make.wordpress.org/core/tag/passwords/) # Passwords in 4.3: Strong by Default One of the development efforts in the WordPress 4.3 cycle was improving the way that passwords are chosen and changed. Before, people had to start from scratch when choosing a password. They were presented with an empty box, and had to use a really terrible tool for generating secure passwords: the human brain. Here’s how things look now, as we approach 4.3’s release candidaterelease candidate One of the final stages in the version release cycle, this version signals the potential to be a final release to the public. Also see [alpha (beta)](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?output_format=md#alpha-beta).… [⌊Screen Shot⌉⌊Screen Shot⌉[ And when you click that button… [⌊Screen Shot⌉⌊Screen Shot⌉[ You start out with a strong password. And if you like, you can just accept that. Most modern browsers will offer to remember it for you (as well as password managers like 1Password and LastPass). Or, you could go old school and write it on a sticky note. Hey: anything is better than choosing “letmein”! You can, of course, click into the field and edit it. But now the password strength meter is better integrated with the field. Things start to look dire as you go your own way. [⌊Screen Shot⌉⌊Screen Shot⌉[ That red seems to signal danger. And hey, look, below. This password is SO BAD that WordPress wants to make extra sure you know you’re doing something monstrously foolhardy. If you’re in a public location, you can hide your password, to prevent people from peeking over your shoulder. [⌊Screen Shot⌉⌊Screen Shot⌉[ This new interface is also integrated into the Add New User screen. By default, we won’t even reveal the password. We’ll just send the user a reset link. [⌊Screen Shot⌉⌊Screen Shot⌉[ But if you’re in a non-email environment or would like to pass this password to the user in a secure method such as iMessage, Signal, or TextSecure, you can reveal it… [⌊Screen Shot⌉⌊Screen Shot⌉[ The new interface can also be found on the password reset screen and the WordPress install screen. They all start you out with a long, random, unguessable password. Although WordPress isn’t stopping you from choosing terrible passwords, the default in 4.3 is that you get secure passwords, and making them less secure takes a bit of work. In addition to this new UIUI User interface, we have also stopped e-mailing passwords, so valid passwords aren’t going to sit in your e-mail inbox, waiting for some future e-mail hacker to gain access. Password reset links now expire in 24 hours by default. And when your password or e-mail changes, we send you an e-mail (in the case of e-mail, to your **old** address), so if someone hijacks your browser session and changes those critical items, at least you’ll be aware that it happened, and you can take action. You can disable these e-mails via the `send_password_change_email` and `send_email_change_email` filters (just have them return false). Huge thanks to everyone who contributed code, testing, UI, and thoughtful feedback on this feature! [#4-3](https://make.wordpress.org/core/tag/4-3/), [#dev-notes](https://make.wordpress.org/core/tag/dev-notes/), [#passwords](https://make.wordpress.org/core/tag/passwords/) ### Share this: * [ Threads ](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?share=threads) * [ Mastodon ](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?share=mastodon) * [ Bluesky ](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?share=bluesky) * [ X ](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?share=x) * [ Facebook ](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?share=facebook) * [ LinkedIn ](https://make.wordpress.org/core/2015/07/28/passwords-strong-by-default/?share=linkedin) 1. ![](https://secure.gravatar.com/avatar/c64b8f97639b146b3a504e7d2cb44a6d7296f3a607e767abe41fa2cbc50cadbc? s=32&d=mm&r=g) 2. [Pippin Williamson](https://profiles.wordpress.org/mordauk/) 11:59 pm _on_ July 28, 2015 3. Hurray! 4. ![](https://secure.gravatar.com/avatar/5e51f45e09f66d4f352ab92ac8391d1ae0ffe784f53dc4e3b3ddc222925b72c5? s=32&d=mm&r=g) 5. [Dylan Ryan](https://profiles.wordpress.org/irkanu/) 3:19 am _on_ July 29, 2015 6. +1 7. ![](https://secure.gravatar.com/avatar/9e6583bcbe4831c87f40523ded6be4ca1ad48833133bd542c4672d4ca4e54081? s=32&d=mm&r=g) 8. [Gary Jones](https://profiles.wordpress.org/garyj/) 7:34 am _on_ July 29, 2015 9. Excellent stuff. All of this is a real step forward. Thank you to all those who contributed. 10. Is the code modular enough that it can be applied to the front-end (e.g. via a function call in a template), as part of a visitor sign-up / checkout with a registration process? 11. * ![](https://secure.gravatar.com/avatar/c5be0bfc715f26c6000ab8a4dca907b962a33ca2e2e9911d2371826cc73ebf94? s=32&d=mm&r=g) * [spivurno](https://profiles.wordpress.org/spivurno/) 10:55 am _on_ July 29, 2015 * Also interested in this answer. * ![](https://secure.gravatar.com/avatar/626975e3c76e0365df131be6d57f3e77660467377d2a4d3c16dcda6c1bdde3c8? s=32&d=mm&r=g) * [Inggo](https://profiles.wordpress.org/inggo/) 1:14 pm _on_ July 29, 2015 * Similarly interested in this as well. * ![](https://secure.gravatar.com/avatar/f8b3e78da513af70d22b0a942297a300eef15e3ce8080e877c054ebb83e24d82? s=32&d=mm&r=g) * [John James Jacoby](https://profiles.wordpress.org/johnjamesjacoby/) 2:05 pm _on_ July 29, 2015 * In my opinion, no; the code is not currently written to make it easy to pull into a template part. * That said, the HTMLHTML HyperText Markup Language. The semantic scripting language primarily used for outputting content in web browsers. and accompanying CSSCSS Cascading Style Sheets. & JSJS JavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors. is very simple, and could be encapsulated relatively easily in a future release. * Look for BuddyPress and bbPressbbPress Free, open source software built on top of WordPress for easily creating forums on sites. [https://bbpress.org](https://bbpress.org) to go this route soon, and contribute upstream where possible. - ![](https://secure.gravatar.com/avatar/f847340cac151352b0bc321c16df9a032472b24bd496730d22dbecdaa1dbeec8? s=32&d=mm&r=g) - [FolioVision](https://profiles.wordpress.org/foliovision/) 9:45 pm _on_ August 1, 2015 - Yes, let’s take this excellent security start and make it modular. Thanks Mark! 12. ![](https://secure.gravatar.com/avatar/e3171496e198834c638911ad3c3220bec77871cdf6557eaa9e2a58d16600a1a1? s=32&d=mm&r=g) 13. [Gustavo Bordoni](https://profiles.wordpress.org/bordoni/) 7:52 am _on_ July 29, 2015 14. What an Awesome update! Real good to see this to become a reality. 15. ![](https://secure.gravatar.com/avatar/510d10a58d13cb587658fbae740f95bc94958e902ebb488c33796ea4fbf1c0b9? s=32&d=mm&r=g) 16. [TobiasBg](https://profiles.wordpress.org/tobiasbg/) 7:57 am _on_ July 29, 2015 17. Can I suggest to rename the filterFilter Filters are one of the two types of Hooks [https://codex.wordpress.org/Plugin_API/Hooks](https://codex.wordpress.org/Plugin_API/Hooks). They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. `send_pass_change_email` to `send_password_change_email`? 18. * ![](https://secure.gravatar.com/avatar/b01ec0896d3867ba97ca655f843bce74d396f9018a844d665e5e513297930de1? s=32&d=mm&r=g) * [Rami Yushuvaev](https://profiles.wordpress.org/ramiy/) 7:44 pm _on_ July 29, 2015 * +1 for the name change! - ![](https://secure.gravatar.com/avatar/b01ec0896d3867ba97ca655f843bce74d396f9018a844d665e5e513297930de1? s=32&d=mm&r=g) - [Rami Yushuvaev](https://profiles.wordpress.org/ramiy/) 7:53 pm _on_ July 29, 2015 - Seems like it’s already done: [https://core.trac.wordpress.org/changeset/33486](https://core.trac.wordpress.org/changeset/33486) 19. ![](https://secure.gravatar.com/avatar/ff33a35fe15dcb7997509cfe7857811a230841f3214e9bd7f7ad4d617c083a2a? s=32&d=mm&r=g) 20. [Mario Peshev](https://profiles.wordpress.org/nofearinc/) 8:40 am _on_ July 29, 2015 21. That’s a great update, can’t wait to see it in the next major coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. update. 22. ![](https://secure.gravatar.com/avatar/1469174905fe195a81864dd1adeb3253c22bc5673d6378e05e1832bc74749ada? s=32&d=mm&r=g) 23. [Minion](https://profiles.wordpress.org/sgriesel/) 8:51 am _on_ July 29, 2015 24. “stopped e-mailing passwords…”. I like that! So say if new user created, will the option “Send this password to the new user by email.” also contain link that expires in 24hours? 25. ![](https://secure.gravatar.com/avatar/59be5a085dd2cc872b243fec6eb78f887775972a7d0b63949dd99f8b0c945b4d? s=32&d=mm&r=g) 26. [Collizo4sky](https://profiles.wordpress.org/collizo4sky/) 1:08 pm _on_ July 29, 2015 27. Can’t wait to see this live. Great update. 28. ![](https://secure.gravatar.com/avatar/f8b3e78da513af70d22b0a942297a300eef15e3ce8080e877c054ebb83e24d82? s=32&d=mm&r=g) 29. [John James Jacoby](https://profiles.wordpress.org/johnjamesjacoby/) 2:11 pm _on_ July 29, 2015 30. This is one of those small changes that will make a huge impact on the security of the web. Some users will be confused. Some admins will need to explain to their users why this is now a requirement. Someone will make a pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost- based plugin from a third-party. to revert this back to the pre-4.3 experience. What matters is everyone will be safer and more secure from the start and going forward. 31. Nice work, team! 32. ![](https://secure.gravatar.com/avatar/ec48a48c62cb6f405153b29deac9a718412a06a790d18dc5676e3a472f6cd92e? s=32&d=mm&r=g) 33. [Paradigm5h1f7](https://profiles.wordpress.org/paradigm5h1f7/) 6:38 pm _on_ July 29, 2015 34. I’m hoping that people will actually use this. From this – ” WordPress isn’t stopping you from choosing terrible passwords” – I assume that the worst offenders will continue using their one-password-for-everything… why not make it so the user cannot accept anything less than a strong password? Can the user still choose “ letmein” ?? 35. Also wondering if there can be a way to recommend users get a trusted password manager. Unfortunately, although “Most modern browsers will offer to remember it for you…” – they also store the passwords in plain text so any malware can grab them. This is a long standing issue that Chrome refuses to fix… 36. Just some thoughts. All in all, it’s a good step in the right direction, but maybe preaching to the choir too much. It does look good though, and reinforces that the onus is on users to be secure in their password management. 37. * ![](https://secure.gravatar.com/avatar/f847340cac151352b0bc321c16df9a032472b24bd496730d22dbecdaa1dbeec8? s=32&d=mm&r=g) * [FolioVision](https://profiles.wordpress.org/foliovision/) 9:50 pm _on_ August 1, 2015 * Yes, even though we always [share with clients](https://foliovision.com/sharing-sensitive-information) a long article up about why to use secure passwords and how to do it, nearly half of our clients still insist on emailing passwords. If we were to put our foot down sternly, a good half of those would look for new developers. Some of the password strategies I’ve seen (single easy word used across multiple platforms) make my hair stand on end. * Oh well, we are still living with MAD and drone warfare has started with AI robot soldiers on the way. Humankind wins few prizes for sentience. * Once again, thanks Mark for trying to get new users on the right track and for getting passwords out of email. The workflow is lovely and difficult to evade without being too intrusive. 38. ![](https://secure.gravatar.com/avatar/d990ac2da0204c41571edd94a0c7c54818a5e5b4da2d916300011e6b034c43a5? s=32&d=mm&r=g) 39. [Lara Littlefield](https://profiles.wordpress.org/lchelak/) 2:57 pm _on_ August 10, 2015 40. This is going to be such a huge help to the future security of WordPress. I think it’s a huge win for the “make technical decisions for the user so they don’t have to” column. Thank you for all who made this happen! 41. ![](https://secure.gravatar.com/avatar/ed2c3ccfe9b4cda57477896d9d36272c56305f9391d72522a07a5a5451bf5926? s=32&d=mm&r=g) 42. [Bego Mario Garde](https://profiles.wordpress.org/pixolin/) 4:21 pm _on_ August 10, 2015 43. Certainly a great feature, although there is one thing I don’t quite understand yet: If you click “Generate Password”, the new password is shown in clear text with a “hide” button. From a security standpoint, wouldn’t it be better to reveal the password only after a button “show” has been clicked by the user? The “hide” button seems to come a bit late? 44. ![](https://secure.gravatar.com/avatar/3a9b2f04bd353d91127e19d91c2037644eba898633bceeeab01d03b90dbc80f7? s=32&d=mm&r=g) 45. [katiemeeks](https://profiles.wordpress.org/katiemeeks/) 1:05 pm _on_ August 19, 2015 46. is anyone else having issue with this new update? I add a new user and they never receive the link. They receive an email that provides their username and the password shows as: both. They dont ever receive a reset link or anyway to actually login. 47. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 3:28 pm _on_ August 19, 2015 * It shows as ‘both’ or blank? * ![](https://secure.gravatar.com/avatar/1f422f02b5140cde5d7451e9c803dc9dcce6bf98aa53a0c7dfb203408a8b3ef2? s=32&d=mm&r=g) * [kevinwhoffman](https://profiles.wordpress.org/kevinwhoffman/) 8:14 pm _on_ August 21, 2015 * It looks like the “password: both” issue is related to OptimizePress. Here’s their recommended fix: [https://optimizepress.zendesk.com/hc/en-us/articles/207299298](https://optimizepress.zendesk.com/hc/en-us/articles/207299298) * ![](https://secure.gravatar.com/avatar/67328dc87f1a3622071253b2f29c75a0136bf61ac19222eb74ade922b2438353? s=32&d=mm&r=g) * Anonymous User 3:34 pm _on_ August 24, 2015 * Read the post! - ![](https://secure.gravatar.com/avatar/074a6f21cb8935db594424bcba0805869ca51b180e00e6028151e56b897b0948? s=32&d=mm&r=g) - [Kalle1887](https://profiles.wordpress.org/kalle1887/) 4:16 am _on_ August 28, 2015 - I have that problem as well, and I dont use OptimizePress. That problem really crashes my site, haven`t found a solution yet :-/ 48. ![](https://secure.gravatar.com/avatar/7bfdbbb2bd5865473d18d6034ceeaee5d62f3049d8c3afaaeb3ca0bd845c471a? s=32&d=mm&r=g) 49. [nnagarajan7](https://profiles.wordpress.org/nnagarajan7/) 4:20 pm _on_ August 19, 2015 50. I do not want to send passwords while manually adding a new user. Is it possible to disable sending passwords to users? I do not find this feature in 4.3 but it was there in the earlier versions. How to achieve this. Thanks in advance. 51. * ![](https://secure.gravatar.com/avatar/1f422f02b5140cde5d7451e9c803dc9dcce6bf98aa53a0c7dfb203408a8b3ef2? s=32&d=mm&r=g) * [kevinwhoffman](https://profiles.wordpress.org/kevinwhoffman/) 8:10 pm _on_ August 21, 2015 * I’m also missing the check box in 4.3. I appreciated being able to choose whether to notify new users on a case-by-case basis. Sometimes I would add several new users and then send a password reset link at a later date. The new interface makes it look as though the email is always sent. * ![](https://secure.gravatar.com/avatar/67328dc87f1a3622071253b2f29c75a0136bf61ac19222eb74ade922b2438353? s=32&d=mm&r=g) * Anonymous User 3:34 pm _on_ August 24, 2015 * The feature isn’t there because it’s no longer possible to send the password by email at all. See original post. - ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) - [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 4:16 pm _on_ August 24, 2015 - That said, we SHOULD have a way to add a new user without sending them an email! - [https://core.trac.wordpress.org/ticket/33504](https://core.trac.wordpress.org/ticket/33504) 52. ![](https://secure.gravatar.com/avatar/ef689afc2a30707bed9323173360f290b0ecf743349157288646a61879e699f3? s=32&d=mm&r=g) 53. [docphiliowa](https://profiles.wordpress.org/docphiliowa/) 8:39 pm _on_ August 19, 2015 54. For existing Users: sometimes I need to change someone’s password for them. When I open their account and click ‘Generate Password’ under Account Management, nothing happens. I have tried this in FireFox, Chrome and Edge. 55. How am I supposed to change existing user’s passwords? 56. * ![](https://secure.gravatar.com/avatar/67328dc87f1a3622071253b2f29c75a0136bf61ac19222eb74ade922b2438353? s=32&d=mm&r=g) * Anonymous User 9:07 pm _on_ August 28, 2015 * Mika, absolutely. I already know what I’m going to have to do when I create users: put in a fake email, so that they don’t get that extremely confusing email. I already spent a half hour on the phone with one client who didn’t understand why she was receiving a “re-set your password” email. - ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) - [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 10:30 pm _on_ August 28, 2015 - Right and like I said there’s a ticketticket Created for both bug reports and feature development on the bug tracker. for this and it WILL be fixed 🙂 Promise. - [https://core.trac.wordpress.org/ticket/33504](https://core.trac.wordpress.org/ticket/33504) - I are your champion here 🙂 I agree it’s a horrible thing and I’m sorry I missed it in testing. 57. ![](https://secure.gravatar.com/avatar/bf10f408b8ead81342d6e3dd44fa38a04b5d74ac629831b8d890d501f629f2de? s=32&d=mm&r=g) 58. [coagmano](https://profiles.wordpress.org/coagmano/) 5:30 am _on_ August 20, 2015 59. Is it just me or does this not apply to multisitemultisite Used to describe a WordPress installation with a network of multiple blogs, grouped by sites. This installation type has shared users tables, and creates separate database tables for each blog (wp_posts becomes wp_0_posts). See also **network**, **blog**, ** site**? On my freshly upgraded site, it’s still sending new users their password by email via the email in ‘networknetwork (versus site, blog) settings’>’Welcome User Email’ 60. Is there a way to apply this to multisite too? 61. ![](https://secure.gravatar.com/avatar/67328dc87f1a3622071253b2f29c75a0136bf61ac19222eb74ade922b2438353? s=32&d=mm&r=g) 62. Anonymous User 3:33 pm _on_ August 24, 2015 63. Why do the generated passwords have so many characters? I think this is a big flaw. Password managers don’t work everywhere — in many situations it’s necessary to type in passwords one character at a time, sometimes on a mobile device’s tiny keyboard. That many characters makes this agonizing. So I’m *always* going to change it, for myself and for my clients, to an 8-character password with upper, lower, numerals, and special characters. Why not make it a manageable 8 characters in the first place? 64. ![](https://secure.gravatar.com/avatar/5c706e3619fe81806c669509d3eeafc56bc9d727b44ea56e0d74e5d6f81367b8? s=32&d=mm&r=g) 65. [George Lerner](https://profiles.wordpress.org/lernerconsult/) 7:44 pm _on_ August 24, 2015 66. PattyJAyers: The reason to not make it “an 8-character password with upper, lower, numerals, and special characters” is that way of making passwords is difficult for humans to remember but easily guessed by computers. [http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/) 67. If you’re going to use a less-secure password, at least make it for a user that has Editor privileges or lower. Yes, I am saying have one user account for your own entering posts; and another user with very strong password for your administrator duties. (Don’t log in as Administrator over public Wi-Fi, anyone could have packet sniffing software and get your user name and password.) 68. Everyone should use limiting login attempts, whether via iThemes Security or WordFence, or via the Limit Login Attempts pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory [https://wordpress.org/plugins/](https://wordpress.org/plugins/) or can be cost-based plugin from a third-party. (several years old, but I hear it still works). 69. For mobile devices, 5-8 words is easy to remember, easy to type, and more secure than 8 characters. WordPress 4.3 does allow spaces in passwords. Pick a vivid mini-scene of a movie, describe it in 5-8 words, use your new password three times and you’ll never forget it. [http://computerhelp.glerner.com/2015-wordpress-security-without-technical-knowledge/](http://computerhelp.glerner.com/2015-wordpress-security-without-technical-knowledge/) 70. ![](https://secure.gravatar.com/avatar/b0c8446f2b606e8f61eb9122ed8b3296c09e45d647045d26a2b343d59c965838? s=32&d=mm&r=g) 71. [snowboardmommy](https://profiles.wordpress.org/snowboardmommy/) 5:59 pm _on_ August 25, 2015 72. Is it possible to disable the send password change email only if the adminadmin( and super admin) / super admin changed it for them? Instead of returning false, would it work to see if the current user is the super admin and then return false? Thanks. 73. * ![](https://secure.gravatar.com/avatar/67328dc87f1a3622071253b2f29c75a0136bf61ac19222eb74ade922b2438353? s=32&d=mm&r=g) * Anonymous User 9:05 pm _on_ August 28, 2015 * George Lerner, I do understand about strong passwords. What I’m objecting to is WordPress creating a 20-character password by default. Those are completely unusable in any situation where the password isn’t being “remembered” — which is lots of situations. So it *forces* the person to change it, and they may very well change it to something very weak. On the other hand, if WordPress gave them “8dho%SKa”, they might just keep it. * I know how to create strong passwords with words — I’m not talking about me, but the hundreds of users of my client websites. This change has already confused some of them. I believe this move on the part of WordPress will result in MANY more weak passwords being used. Amazing to me that this isn’t obvious to everybody concerned. Oh well. 74. ![](https://secure.gravatar.com/avatar/caa263585dbc3afd5a7096953ded1ede8bc3b2d21a9ad0c46c3debc3d51b023e? s=32&d=mm&r=g) 75. [tradeshark](https://profiles.wordpress.org/tradeshark/) 5:38 pm _on_ August 27, 2015 76. In 4.3 new users get an email saying their password is “both”. What could cause this? 77. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 8:17 pm _on_ August 27, 2015 * Support requests should be posted in the forums, not in the make blogs. * In this case, your answer is in the master list: [https://wordpress.org/support/topic/read-this-first-%E2%80%93-wordpress-43-master-list?replies=4&view=all#post-7314897](https://wordpress.org/support/topic/read-this-first-%E2%80%93-wordpress-43-master-list?replies=4&view=all#post-7314897) * OptimizePress sends registration emails with the password set to ‘both’. Please disable that setting in OptimizePress 78. ![](https://secure.gravatar.com/avatar/3711cbd37394309540cf247570bbb7fe0efebc35fb5842f23ec5c2c6ecda9b7c? s=32&d=mm&r=g) 79. [Panda4Life](https://profiles.wordpress.org/panda4life/) 8:15 am _on_ September 1, 2015 80. As I want to generate a new password for an existing user under wordpress 4.3 this is not possible. Nothing happens. Any fix for this? 81. * ![](https://secure.gravatar.com/avatar/27180c82524020e7339e2b30818b6d8ab004c54f730f12b1434b1e365be0e175? s=32&d=mm&r=g) * [Ipstenu (Mika Epstein)](https://profiles.wordpress.org/ipstenu/) 2:55 pm _on_ September 1, 2015 * This works fine on a clean version of WP 4.3 – just click on generate password and save the user profile. 82. ![](https://secure.gravatar.com/avatar/31173dce4505cccd8e1aa1e0126e69f1c1a0e25d6deeb596dfa0d9e3c3406ad5? s=32&d=mm&r=g) 83. [wpmnger](https://profiles.wordpress.org/wpmnger/) 2:04 pm _on_ September 1, 2015 84. Thanks for this security enhancementenhancement Enhancements are simple improvements to WordPress, such as the addition of a hook, a new feature, or an improvement to an existing feature.! However, our users are confused by the reset password screen. We have had users copy pasting the auto generated password and then trying to log in without actually applying the new password. 85. I’ve been searching for a way to either: 1. Revert back to the new password and confirm new password screen 2. start the reset password process with a blank field and a button to ‘Generate strong password’ 3. merge the two options 86. The distance between the new password and the reset password button (the Hint is inbetween) causes users to miss the step that they have to press the button for the new password to take effect. 87. Does anyone know of a fix for this? 88. Many thanks 89. ![](https://secure.gravatar.com/avatar/03ef35fb458e467da379fe8d77379e5bf990eb56880365b6e88825fb4827c676? s=32&d=mm&r=g) 90. [theresa.webdev@gmail.com](https://profiles.wordpress.org/theresawebdevgmailcom/) 6:59 pm _on_ September 24, 2015 91. Is it defined somewhere what constitutes a strong password? what length? are caps required, are special characters required etc etc 92. * ![](https://secure.gravatar.com/avatar/bf10f408b8ead81342d6e3dd44fa38a04b5d74ac629831b8d890d501f629f2de? s=32&d=mm&r=g) * [coagmano](https://profiles.wordpress.org/coagmano/) 5:24 am _on_ November 19, 2015 * I’m pretty sure they use zxcvbn to test password strength: [https://github.com/dropbox/zxcvbn](https://github.com/dropbox/zxcvbn) * It works on bits of entropy, ie. how easy it is for a computer to guess. It takes words, patterns, and other common password factors into account, rather than arbitrary rules for letters/numbers/symbols. 93. ![](https://secure.gravatar.com/avatar/4e12906d2339addfc1693f16e8622e2f62102b976128298e157a520f744dda7a? s=32&d=mm&r=g) 94. [frankangelone](https://profiles.wordpress.org/frankangelone/) 4:45 pm _on_ November 8, 2015 95. When these new passwords are generated and saved in the database, how are the passwords encrypted for security purposes? Is salt hashing being used? Thanks in advance. 96. * ![](https://secure.gravatar.com/avatar/bf10f408b8ead81342d6e3dd44fa38a04b5d74ac629831b8d890d501f629f2de? s=32&d=mm&r=g) * [coagmano](https://profiles.wordpress.org/coagmano/) 5:25 am _on_ November 19, 2015 * yes, everything is salted and hashed. Comments are closed. # Post navigation [← Site Icon](https://make.wordpress.org/core/2015/07/27/site-icon/) [Dev Chat Agenda for July 29 →](https://make.wordpress.org/core/2015/07/29/dev-chat-agenda-for-july-29/)