wp_verify_fast_hash() │ WP 6.8.0

Checks whether a plaintext message matches the specified hash.

Intended for verifying values created with wp_fast_hash().

For hashes prefixed with $generic$, recalculates the fast hash of the message and performs a timing-safe comparison. Without the prefix, it verifies the value as a portable phpass hash. This provides backward compatibility with old password and security-key hashes.

Uses: wp_fast_hash()

No Hooks.

Returns

bool.

  • true - the message matches the hash.
  • false - the message does not match the hash.

Usage

wp_verify_fast_hash( string $message, $hash ): bool;
$message(string) (required)
The plaintext message to verify.
$hash(string) (required)
The message hash.
Usually created with wp_fast_hash(). Old portable phpass hashes are also supported.

Examples

#1 Verify a message

$message = 'random-secret-value';
$hash    = wp_fast_hash( $message );

if ( wp_verify_fast_hash( $message, $hash ) ) {
	echo 'The hash matches.';
}

Changelog

Since 6.8.0 Introduced.

wp_verify_fast_hash() code WP 7.1.2

wp-includes/functions.php 
function wp_verify_fast_hash(
	#[\SensitiveParameter]
	string $message,
	string $hash
): bool {
	if ( ! str_starts_with( $hash, '$generic$' ) ) {
		// Back-compat for old phpass hashes.
		require_once ABSPATH . WPINC . '/class-phpass.php';
		return ( new PasswordHash( 8, true ) )->CheckPassword( $message, $hash );
	}

	return hash_equals( $hash, wp_fast_hash( $message ) );
}

validate (check vars)

Site security (safety)