wp-includes/class-wp-application-passwords.php:14Class for displaying, modifying, and sanitizing application passwords.
Every hook that fires from inside WP_Application_Passwords, in the order it appears in the class, grouped by the method that fires it.
#[AllowDynamicProperties]class WP_Application_Passwords { /** * The application passwords user meta key. * * @since 5.6.0 * * @var string */ const USERMETA_KEY_APPLICATION_PASSWORDS = '_application_passwords'; /** * The option name used to store whether application passwords are in use. * * @since 5.6.0 * * @var string */ const OPTION_KEY_IN_USE = 'using_application_passwords'; /** * The generated application password length. * * @since 5.6.0 * * @var int */ const PW_LENGTH = 24; /** * Checks if application passwords are being used by the site. * * This returns true if at least one application password has ever been created. * * @since 5.6.0 * * @return bool */ public static function is_in_use() { $network_id = get_main_network_id(); return (bool) get_network_option( $network_id, self::OPTION_KEY_IN_USE ); } /** * Creates a new application password. * * @since 5.6.0 * @since 5.7.0 Returns WP_Error if application name already exists. * @since 6.8.0 The hashed password value now uses wp_fast_hash() instead of phpass. * * @param int $user_id User ID. * @param array $args { * Arguments used to create the application password. * * @type string $name The name of the application password. * @type string $app_id A UUID provided by the application to uniquely identify it. * } * @return array|WP_Error { * Application password details, or a WP_Error instance if an error occurs. * * @type string $0 The generated application password in plain text. * @type array $1 { * The details about the created password. * * @type string $uuid The unique identifier for the application password. * @type string $app_id A UUID provided by the application to uniquely identify it. * @type string $name The name of the application password. * @type string $password A one-way hash of the password. * @type int $created Unix timestamp of when the password was created. * @type null $last_used Null. * @type null $last_ip Null. * } * } */ public static function create_new_application_password( $user_id, $args = array() ) { if ( ! empty( $args['name'] ) ) { $args['name'] = sanitize_text_field( $args['name'] ); }2 changes between 6.7.7 and 7.1.0.
Signature, return type and hooks compared across 5 parsed releases.
hash_password() added.verified against sourcecheck_password() added.verified against sourcesrc/wp-includes/class-wp-application-passwords.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.