<p>There’s no API for it; you would need to save it to the database directly.</p>

<p>If any of the passwords are known to you, you should probably start by manually pasting that hashed password into your account’s password column, and verify that it’s actually going to work. Even if the old site was also using mcrypt, it’s still pretty unlikely that they get hashed the <em>exact</em> same way (different salts, etc.).</p>

<p>If it doesn’t work out, and you really don’t want to require everyone to reset their passwords, you could save all of your hashed passwords in a separate table, and write your own "login" controller action using a plugin. That controller action could:</p>

<ul>
<li><p>grab the user by their given username/email</p>

<pre><code>$loginName = craft()-&gt;request-&gt;getPost('loginName');
$user = craft()-&gt;users-&gt;getUserByUsernameOrEmail($loginName);
</code></pre></li>
<li><p>see if that user has a row in your old hashed passwords table</p></li>
<li><p>if so, fetch their password from post...</p>

<pre><code>$password = craft()-&gt;request-&gt;getPost('password');
</code></pre></li>
<li><p>hash that password using the old site’s exact hashing method</p></li>
<li>if the hashed password matches the one in the table...</li>
<li><p>save the posted password on the user account</p>

<pre><code>$user-&gt;newPassword = $password;
craft()-&gt;users-&gt;changePassword($user);
</code></pre></li>
<li><p>delete the user’s row in the old hashed passwords table (so we're only doing this once per user)</p></li>
<li><p>log the user in</p>

<pre><code>craft()-&gt;userSession-&gt;login($loginName, $password);
</code></pre></li>
</ul>

<p>(See craft/app/controllers/UsersController.php - actionLogin() for a full code example of <code>login()</code>.)</p>

CC BY-SA 3.0
2014-07-22T13:06:52.077Z
Thanks for the response. Yeah they do work between the two systems, we've got that all working great. Crafts hashing system has been matched on the other side so users can use the same password between the two sites for a single sign-on set up. So it's less about importing a heap of existing users from another site, and the risk of them having to reset passwords, and more about keeping everything in sync.
Adam
CC BY-SA 3.0
2014-07-22T17:09:39.810Z
Got it working with `db->createCommand()`. Thanks!
Adam
CC BY-SA 3.0
2014-07-22T11:57:53.953Z
2014-07-22T11:57:53.953Z
Brandon Kelly
<p>Related to <a href="https://craftcms.stackexchange.com/questions/1197/how-do-i-change-a-users-password-programmatically-in-a-plugin">this question</a> - with one difference. </p>

<p>Is it possible to set a hashed password for a user? I'm able to save the user just fine - but when I pass the already hashed password like <code>$user-&gt;password</code> it doesn't set the password. I'm not seeing anything within <code>$user-&gt;getErrors()</code>, it's just a blank array. Any ideas?</p>

CC BY-SA 3.0
2014-07-22T11:36:47.810Z
Why set the already hashed password when it's hashed for you? Is it from an import? If so, you need to make sure the has is the same and import it manually into the database, but that starts leaping into dangerous territory.
Bryan Redeagle
CC BY-SA 3.0
2014-07-22T11:38:41.693Z
That's right - it's importing from an external system to synchronise passwords. I don't have access to the users raw password, just the hashed password which is hashed using the same password hashing approach as Craft utilises. So it's not possible to save a hashed password without hitting the database directly?
Adam
CC BY-SA 3.0
2014-07-22T11:50:30.990Z
As far as I know. I would shoot a support ticket to Pixel & Tonic, and post their answer to your own question.
Bryan Redeagle
<users>
Is it possible to set a hashed password programatically for a user?
# Is it possible to set a hashed password programatically for a user?

(Asked by: username_0 on 2014-07-22)

Related to [this question](https://craftcms.stackexchange.com/questions/1197/how-do-i-change-a-users-password-programmatically-in-a-plugin) - with one difference.

Is it possible to set a hashed password for a user? I'm able to save the user just fine - but when I pass the already hashed password like `$user->password` it doesn't set the password. I'm not seeing anything within `$user->getErrors()`, it's just a blank array. Any ideas?

**Tags:** users

> **Comments:**
> **username_1**: Why set the already hashed password when it's hashed for you? Is it from an import? If so, you need to make sure the has is the same and import it manually into the database, but that starts leaping into dangerous territory.  
> **username_0**: That's right - it's importing from an external system to synchronise passwords. I don't have access to the users raw password, just the hashed password which is hashed using the same password hashing approach as Craft utilises. So it's not possible to save a hashed password without hitting the database directly?  
> **username_1**: As far as I know. I would shoot a support ticket to Pixel & Tonic, and post their answer to your own question.  

---

## 1 answers

### Answer by username_2 on 2014-07-22. Score: 4 | Accepted answer

There’s no API for it; you would need to save it to the database directly.
If any of the passwords are known to you, you should probably start by manually pasting that hashed password into your account’s password column, and verify that it’s actually going to work. Even if the old site was also using mcrypt, it’s still pretty unlikely that they get hashed the exact same way (different salts, etc.).
If it doesn’t work out, and you really don’t want to require everyone to reset their passwords, you could save all of your hashed passwords in a separate table, and write your own "login" controller action using a plugin. That controller action could:

grab the user by their given username/email
$loginName = craft()->request->getPost('loginName');
$user = craft()->users->getUserByUsernameOrEmail($loginName);

see if that user has a row in your old hashed passwords table
if so, fetch their password from post...
$password = craft()->request->getPost('password');

hash that password using the old site’s exact hashing method
if the hashed password matches the one in the table...
save the posted password on the user account
$user->newPassword = $password;
craft()->users->changePassword($user);

delete the user’s row in the old hashed passwords table (so we're only doing this once per user)
log the user in
craft()->userSession->login($loginName, $password);


(See craft/app/controllers/UsersController.php - actionLogin() for a full code example of login().)

> **Comments:**
> **username_0**: Thanks for the response. Yeah they do work between the two systems, we've got that all working great. Crafts hashing system has been matched on the other side so users can use the same password between the two sites for a single sign-on set up. So it's less about importing a heap of existing users from another site, and the risk of them having to reset passwords, and more about keeping everything in sync.  
> **username_0**: Got it working with `db->createCommand()`. Thanks!  

---

