Question 1

What's the Drupal $S$ format?

Accepted Answer

Drupal 7+ uses a modified version of phpass with SHA-512 instead of MD5. The format is $S$<8-char-salt><43-char-checksum> — 55 characters total. The countLog2 (typically 'D' = 15 → 2^15 iterations) determines how many rounds run. The algorithm: salt the password, hash with SHA-512, then iterate (hash(prev_hash + password)) 2^countLog2 times. This is the format stored in the users_field_data.pass column (or users.pass in Drupal 7).

Question 2

How do I apply this to my Drupal database?

Accepted Answer

In Drupal 8/9/10: `UPDATE users_field_data SET pass = '$S$D...' WHERE name = 'admin';`. In Drupal 7: `UPDATE users SET pass = '$S$D...' WHERE name = 'admin';`. Drush alternative: `drush user:password admin 'plain-password'` (Drush handles the hashing for you). After updating, clear the cache: `drush cr` or via admin UI.

Question 3

Why does Drupal use a different format than WordPress?

Accepted Answer

Both WordPress and Drupal use phpass (the Portable PHP password hashing framework), but Drupal modified phpass to use SHA-512 instead of MD5 — both stronger and more iterations. The $P$ prefix is WordPress's phpass; $S$ is Drupal's SHA-512 variant. The algorithm structure is identical but the inner hash function differs. This is why a WordPress hash won't validate in Drupal and vice versa.

Drupal Password Hash Generator

Frequently Asked Questions