wp_hash_password( string $password ): string

2753	function wp_hash_password(2754		#[\SensitiveParameter]2755		$password2756	) {2757		global $wp_hasher;2758 2759		if ( ! empty( $wp_hasher ) ) {2760			return $wp_hasher->HashPassword( trim( $password ) );2761		}2762 2763		if ( strlen( $password ) > 4096 ) {2764			return '*';2765		}2766 2767		/**2768		 * Filters the hashing algorithm to use in the password_hash() and password_needs_rehash() functions.2769		 *2770		 * The default is the value of the `PASSWORD_BCRYPT` constant which means bcrypt is used.2771		 *2772		 * **Important:** The only password hashing algorithm that is guaranteed to be available across PHP2773		 * installations is bcrypt. If you use any other algorithm you must make sure that it is available on2774		 * the server. The `password_algos()` function can be used to check which hashing algorithms are available.2775		 *2776		 * The hashing options can be controlled via the {@see 'wp_hash_password_options'} filter.2777		 *2778		 * Other available constants include:2779		 *2780		 * - `PASSWORD_ARGON2I`2781		 * - `PASSWORD_ARGON2ID`2782		 * - `PASSWORD_DEFAULT`2783		 *2784		 * @since 6.8.02785		 * @since 7.0.0 The `$algorithm` parameter is now always a string.2786		 *2787		 * @param string $algorithm The hashing algorithm. Default is the value of the `PASSWORD_BCRYPT` constant.2788		 */2789		$algorithm = apply_filters( 'wp_hash_password_algorithm', PASSWORD_BCRYPT );2790 2791		/**2792		 * Filters the options passed to the password_hash() and password_needs_rehash() functions.2793		 *2794		 * The default hashing algorithm is bcrypt, but this can be changed via the {@see 'wp_hash_password_algorithm'}2795		 * filter. You must ensure that the options are appropriate for the algorithm in use.2796		 *2797		 * @since 6.8.02798		 * @since 7.0.0 The `$algorithm` parameter is now always a string.2799		 *2800		 * @param array  $options   Array of options to pass to the password hashing functions.2801		 *                          By default this is an empty array which means the default2802		 *                          options will be used.2803		 * @param string $algorithm The hashing algorithm in use.2804		 */2805		$options = apply_filters( 'wp_hash_password_options', array(), $algorithm );2806 2807		// Algorithms other than bcrypt don't need to use pre-hashing.2808		if ( PASSWORD_BCRYPT !== $algorithm ) {2809			return password_hash( $password, $algorithm, $options );2810		}2811 2812		// Use SHA-384 to retain entropy from a password that's longer than 72 bytes, and a `wp-sha384` key for domain separation.2813		$password_to_hash = base64_encode( hash_hmac( 'sha384', trim( $password ), 'wp-sha384', true ) );2814 2815		// Add a prefix to facilitate distinguishing vanilla bcrypt hashes.2816		return '$wp' . password_hash( $password_to_hash, $algorithm, $options );2817	}