I am using the Feed module in Drupal to import the list of my users from WordPress and I have faced a big problem: The password field mapping in the Feed module says "unencrypted password", and there is no way of decrypting phpass WordPress passwords into a CSV file (it is not even safe). What should I do?

  • I down voted the question as I find the title quite misleading. Please consider fixing that.
    – Letharion
    Feb 2, 2013 at 18:46
  • @Kiamlaluno, sorry to be nit-picking, but I don't think this title is better. Now the title says the question is wordpress related, while the body says it's about feeds.
    – Letharion
    Feb 4, 2013 at 10:42
  • The question title doesn't suggest the question is about WordPress. It says the question is about migrating user passwords from WordPress. Any reference to Drupal in the title is not necessary, since this site is about Drupal.
    – apaderno
    Feb 4, 2013 at 13:25

3 Answers 3


Instead of trying to decrypt users passwords, and then re-encrypt them to be stored in drupal. Why dont you:

  • import the users all over into drupal
  • get all users to reset there own passwords (through the normal email method) when they next try to login
  • Thats an alternative, however i would like to see if there is a way of having them to just login with the same password they were using. any ideas??
    – alex
    Dec 1, 2011 at 23:50
  • any idea? im still stuck in this one!
    – alex
    Dec 3, 2011 at 21:57

You cannot decrypt the passwords, simply because you don't have encrypted passwords, but values returned from a function that calculates the hash of the given parameter. The hash is a one-way value: You can get it from the input, but you cannot calculate the input given its hash.

What you can do is:

  • Setting the password to a random value, using user_hash_password()
  • Show a message to the users telling them they need to reset their password

The right way to call user_hash_password() is the following one.

require_once DRUPAL_ROOT . '/' . variable_get('password_inc', 'includes/password.inc');
$hash = user_hash_password($password);

The method found at https://www.drupal.org/sandbox/selexin/2384473 works like a charm.

The idea is simple. The module uses the Wordpress hasher and salter to check the entered password against (read the modules readme). If they match, then the password is correct and the users entered password is rehashed with Drupal's hasher and salter, then saved to database. So the idea would be that you would use this for a period of time after initial release then remove the module. Any existing users (that have not logged in) would then have to reset password.

Additionally, to get the wordpress hash I used Feeds to import the users. Which currently does not allow you to import user->pass.

After I did this, I added the wordpress database to the settings.php as a second database. Ran a quick Views Bulk Operations PHP operation on all the users.

$id = db_query('SELECT guid FROM {feeds_item} WHERE entity_id = :uid AND id = :id', array(':uid' => $entity->uid, ':id' => 'wp_users'))->fetchField();

  $user_hash = db_query('SELECT user_pass FROM {wp_users} WHERE ID = :id', array(':id' => $id))->fetchField();

  $entity->pass = $user_hash;
  entity_save('user', $entity);

I am sure there are numerous other ways of achieving those last few steps, but that seemed the quickest for me.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.