Why WordPress password hashes can't move to Shopify (and what customers use instead)

#wordpress #shopify #woocommerce #webdev

Every WooCommerce to Shopify migration hits the same question: "Can we bring the customers' passwords?" The short answer is no. The more useful answer is that on Shopify's current customer accounts, customers don't need one.

Here's why the hashes can't travel, and what to do instead.

What WordPress actually stores

WooCommerce customers are WordPress users. WordPress never stores the password, only a one-way hash in wp_users.user_pass. A typical store has two kinds:

Prefix	Algorithm
$P$	phpass, the default before WordPress 6.8
`$wp$2y$`	bcrypt with a SHA-384 pre-hash, the default since 6.8 (April 2025)

WordPress 6.8 didn't reset anything. An old $P$ hash is upgraded to $wp$2y$ only when that user next logs in or changes their password. So a store that's been running for years has a mix: recent shoppers on bcrypt, and dormant customers still on phpass. Some sites also have plain $2y$ hashes from a security plugin that used bcrypt before core did.

You can check this yourself:

SELECT CASE
         WHEN user_pass LIKE '$wp$2y$%' THEN 'bcrypt (6.8+)'
         WHEN user_pass LIKE '$P$%' THEN 'phpass'
         WHEN user_pass LIKE '$2y$%' THEN 'plain bcrypt'
         ELSE 'other (MD5 or plugin)'
       END AS hash_type,
       COUNT(*) AS users
FROM wp_users
GROUP BY hash_type;

(Change wp_ if your table prefix is different.)

Why Shopify can't take them

There's nowhere to put them. Shopify's customer CSV has no password column, and its help center says customer passwords can't be migrated from another store by CSV. There's also no setting that tells Shopify to check a login "the WordPress way", which is what you'd need to keep a phpass hash working.

Some paid migration services sell a "customer passwords" add-on. If you're offered one, ask which customer accounts version it relies on and what happens when that version is retired. You'll see why below.

The part most guides miss: no password at all

Shopify has two customer account systems:

Current customer accounts are the only option for new stores since February 2026. An imported customer already has an account. They enter their email, get a one-time 6-digit code, and they're signed in. Shopify's help center says "A password isn't required to sign in." You can add Sign in with Shop, Google or Facebook, and sessions last up to 365 days.
Legacy customer accounts were deprecated on February 26, 2026. They're closed to new stores, get no feature updates or support, and Shopify says a final sunset date will be announced later in 2026. On legacy accounts, imported customers have to accept an invite and set a new password before they can sign in.

So the old advice to "email everyone a link to create a new password" only applies to legacy stores. On current accounts there's no password to reset, and an email that looks like a reset link mostly confuses people and looks like phishing.

Check which one you're on in Settings > Customer accounts. If you're moving into an older store still on legacy accounts, upgrade before launch, not after.

The import, in order

Export from WooCommerce (Analytics > Customers > Download). Decide whether guests with orders become customers, because on current accounts every imported profile can sign in.
Dedupe by email. Shopify keeps only the last row for a duplicate email or phone, which may be the oldest address.
Build the CSV with Shopify's columns. Country and province are ISO codes, and Total Spent and Total Orders are ignored on import. Each file must be 15 MB or smaller. Tag every row (for example woo-import) so you can segment the launch email.
Carry consent honestly. Accepts Email Marketing, SMS and WhatsApp are separate yes/no columns. Anyone who opted out, bounced or complained is no. On most WooCommerce stores the real consent data lives in the email platform, not in WooCommerce.
Import products, then customers, then orders, and do it on a development store first.
Test sign-in as a real imported customer from a normal inbox on a phone, not with a staff account.

Headless and SSO notes

On Shopify Plus you can connect your own OpenID Connect identity provider instead of Shopify's sign-in. Multipass is closed to new stores.
For headless storefronts, Shopify recommends the Customer Account API. It has said the Storefront API customer mutations, such as customerActivate, will be deprecated.

What to tell customers

Send one short service email at launch. Say the store moved, their orders and addresses came with it, and next time they'll sign in with a code sent by email. Leave out offers and password-reset wording, and send it from the domain they already know.

I wrote up the full process, including the launch email checklist and the mistakes that cause login complaints on day one, here: WooCommerce to Shopify customer passwords.

DEV Community