WordPress has a password generator built in. It is not a separate tool or a plugin — it is the “Generate password” button on the user profile screen, the reset link page, and the installer, all calling the same function: wp_generate_password().
Used well, it produces passwords stronger than anything a human invents. Used carelessly, it produces a 12-character string that nobody stored, on a site with no two-factor authentication. This guide covers both halves.
Where the built-in generator lives
- Users → Add New. Click “Generate password”, then “Show password” to copy it before saving.
- Users → Profile. Scroll to Account Management → Set New Password → Generate.
- The password reset screen. WordPress suggests a strong password when you follow a reset link.
- Under the hood. All three call
wp_generate_password( $length = 12, $special_chars = true, $extra_special_chars = false ).
WordPress’s own documentation notes that it draws from wp_rand(), which gives “far less predictability than similar native PHP functions like rand() or mt_rand()”. That matters: predictable randomness is how generated passwords get guessed.
What the default gets right, and what it does not
| Default behaviour | Verdict |
|---|---|
| 12 characters | Acceptable today; 16–20 is better for admin accounts |
| Special characters on | Good — larger character set |
| No “extra special” by default | Fine for web logins, avoid for shells |
| Shown in plain text on screen | Expected; copy it immediately |
| Not stored anywhere | Your responsibility — this is where it fails |
The weak point is not the algorithm. It is that the generated password appears once, gets clicked away, and is then reset to something memorable like BusinessName2026!. A generated password nobody saved is worse than a passphrase somebody remembers.
Generating longer passwords
Twelve characters is the default; a site administrator can generate 20 with one line of code in a plugin or child theme:
echo esc_html( wp_generate_password( 20, true, false ) );From the command line, when you have WP-CLI:
wp eval 'echo wp_generate_password( 24 ) . "\n";'
NEW=$(wp eval 'echo wp_generate_password( 24 );')
wp user update 3 --user_pass="$NEW"Length beats complexity. A 24-character random string is not meaningfully harder to brute-force than a 16-character one — both are beyond reach — but both beat a 10-character one with three symbols in it.
Application passwords: the feature people miss
Since WordPress 5.6, Users → Profile has an “Application Passwords” section. It creates a separate password for one specific tool — a backup service, a monitoring script, a publishing bot — and displays it once.
Use it instead of your real password anywhere software needs to authenticate. The benefits are concrete:
- It can be revoked individually without changing your password.
- A leak from one tool does not hand over the whole account.
- It bypasses two-factor prompts, so automation keeps working.
The same principle applies to SFTP and hosting panel credentials: separate, revocable, per-tool.
Where passwords fit in a bigger defence
A strong password is one layer. The rest, in order of effect:
- Two-factor authentication on WordPress admins and on the hosting account.
- A password manager so every site has a different password, generated, not reused.
- Login attempt limiting so guessing is throttled rather than free.
- Rotating the security keys and salts in
wp-config.php— this invalidates every existing session, which is the fastest way to eject an intruder. - Breach checks — if an address appears in a known breach, rotate that password before anything else.
Rotating salts: the two-minute security win
Visit api.wordpress.org/secret-key/1.1/salt/, copy the eight generated define() lines, and replace the eight equivalent lines in wp-config.php. Everyone is logged out; password-reset links and cookies are invalidated. It is the recommended response to a suspected compromise, and it is also fine to do periodically.
No plugin needed, no downtime, and it is the step people skip when a login has been stolen.
What the generator cannot do
- Make you store it. If the password lives in a note app or a browser profile on a shared machine, generation was the least of your problems.
- Stop credential stuffing. If you reuse the same generated password across sites, one breach exposes all of them.
- Replace two-factor. A generated password with no 2FA still falls to a phishing page that captures it in real time.
A practical routine
- Every new site: generate 20+ characters, store it in the manager, enable 2FA immediately.
- Every automated tool: application password, named after the tool, revoked when the tool goes.
- Every staff departure: generate a new password for any shared account, rotate salts if the person had admin access.
- Once a year: rotate the hosting panel password and the admin password, and re-check the user list for accounts you do not recognise.
Our Hostinger login protection guide covers the host-side doors, and the WordPress care plans include user audits and access reviews if you would rather not track this yourself.
FAQ
Is the WordPress password generator secure?
Yes — it uses a cryptographically better random source than PHP’s default functions, and the character set is broad. Its security depends on what you do with the output.
How long should a WordPress admin password be?
Twenty characters, generated, stored in a manager. Length is what makes guessing infeasible; the specific symbols matter far less.
Should I change my password regularly?
Current guidance favours long unique passwords plus 2FA over scheduled rotation, which tends to produce predictable patterns. Rotate after any breach, staff change or shared-account handover.
What is an application password for?
Giving one specific tool access without exposing your main password. Create one per tool, revoke it when the tool is retired.