get_password_reset_key() │ WP 4.4.0

Creates a key in the database for password recovery for the specified user and returns this key.

The created key is saved in the wp_users table in the user_activation_key field. Before saving, the key is hashed using the PasswordHash() class and a timestamp of its creation is added: 1523344279:$P$B1WitfrdGBKDfc8G3ESq.shs5ljDno.

This key is used by the WordPress core in the standard password recovery link that is sent to the user's email.

Example code for creating such a link:

network_site_url( "wp-login.php?action=rp&key=$key&login=" . rawurlencode( $user_login ), 'login' )

// will get
// http://example.com/wp-login.php?action=rp&login=login&key=DNNipiJcP3IcasDtPqIQ

The key is created using the function wp_generate_password().

To check if the key is valid, use the function check_password_reset_key().

Hooks from the function

Returns

String|WP_Error.

  • Key for password reset.
  • WP_Error when the user is not allowed to create a key or when the key could not be written to the database.

Usage

get_password_reset_key( $user );
$user(WP_User) (required)
User object for which to create the key.

Examples

0

#1 Create a key to restore the password 

$user = get_userdata( 1 );

echo get_password_reset_key( $user ); // ZedUm9FEt48Kp4aGb5i8

Changelog

Since 4.4.0 Introduced.

get_password_reset_key() code WP 6.8.3

wp-includes/user.php 
function get_password_reset_key( $user ) {
	if ( ! ( $user instanceof WP_User ) ) {
		return new WP_Error( 'invalidcombo', __( '<strong>Error:</strong> There is no account with that username or email address.' ) );
	}

	/**
	 * Fires before a new password is retrieved.
	 *
	 * Use the {@see 'retrieve_password'} hook instead.
	 *
	 * @since 1.5.0
	 * @deprecated 1.5.1 Misspelled. Use {@see 'retrieve_password'} hook instead.
	 *
	 * @param string $user_login The user login name.
	 */
	do_action_deprecated( 'retreive_password', array( $user->user_login ), '1.5.1', 'retrieve_password' );

	/**
	 * Fires before a new password is retrieved.
	 *
	 * @since 1.5.1
	 *
	 * @param string $user_login The user login name.
	 */
	do_action( 'retrieve_password', $user->user_login );

	$password_reset_allowed = wp_is_password_reset_allowed_for_user( $user );
	if ( ! $password_reset_allowed ) {
		return new WP_Error( 'no_password_reset', __( 'Password reset is not allowed for this user' ) );
	} elseif ( is_wp_error( $password_reset_allowed ) ) {
		return $password_reset_allowed;
	}

	// Generate something random for a password reset key.
	$key = wp_generate_password( 20, false );

	/**
	 * Fires when a password reset key is generated.
	 *
	 * @since 2.5.0
	 *
	 * @param string $user_login The username for the user.
	 * @param string $key        The generated password reset key.
	 */
	do_action( 'retrieve_password_key', $user->user_login, $key );

	$hashed = time() . ':' . wp_fast_hash( $key );

	$key_saved = wp_update_user(
		array(
			'ID'                  => $user->ID,
			'user_activation_key' => $hashed,
		)
	);

	if ( is_wp_error( $key_saved ) ) {
		return $key_saved;
	}

	return $key;
}

password

Login/Logout