{"id":387440,"date":"2026-10-15T08:24:21","date_gmt":"2026-10-15T08:24:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/newtiv-migrate\/"},"modified":"2026-10-15T08:23:55","modified_gmt":"2026-10-15T08:23:55","slug":"newtiv-migrate","status":"publish","type":"plugin","link":"https:\/\/srd.wordpress.org\/plugins\/newtiv-migrate\/","author":23400215,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.0.0","stable_tag":"1.0.0","tested":"7.1.3","requires":"6.0","requires_php":"7.4","requires_plugins":null,"header_name":"NEWTIV Migrate","header_author":"NEWTIV","header_description":"Export your users (with their password hashes) and your content to a single encrypted file, to move them into a new web application without losing anyone.","assets_banners_color":"","last_updated":"2026-10-15 08:23:55","external_support_url":"","external_repository_url":"","donate_link":"","header_plugin_uri":"","header_author_uri":"https:\/\/www.newtiv.com","rating":0,"author_block_rating":0,"active_installs":0,"downloads":28,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.0.0":{"tag":"1.0.0","author":"newtiv","date":"2026-10-15 08:23:55","revision":3747932}},"upgrade_notice":[],"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3747990,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3747990,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256},"icon.svg":{"filename":"icon.svg","revision":3747990,"resolution":false,"location":"assets","locale":false}},"assets_banners":[],"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.0.0"],"block_files":[],"assets_screenshots":[],"screenshots":[]},"plugin_section":[],"plugin_tags":[1859,141196,4155,1930,1917],"plugin_category":[54,59],"plugin_contributors":[286558],"plugin_business_model":[],"class_list":["post-387440","plugin","type-plugin","status-publish","hentry","plugin_tags-export","plugin_tags-headless","plugin_tags-migration","plugin_tags-password","plugin_tags-users","plugin_category-security-and-spam-protection","plugin_category-utilities-and-tools","plugin_contributors-newtiv","plugin_committers-newtiv"],"banners":[],"icons":{"svg":"https:\/\/ps.w.org\/newtiv-migrate\/assets\/icon.svg?rev=3747990","icon":"https:\/\/ps.w.org\/newtiv-migrate\/assets\/icon.svg?rev=3747990","icon_2x":false,"generated":false},"screenshots":[],"raw_content":"<!--section=description-->\n<p>You are building a new web or mobile application and want to keep the people who already have an account on your WordPress site. NEWTIV Migrate exports, in one file:<\/p>\n\n<ul>\n<li><strong>users<\/strong>: username, email, name, registration date, roles, and optionally their <strong>password hashes<\/strong>, profile fields, WooCommerce addresses and any other user meta you name;<\/li>\n<li><strong>content<\/strong>: posts, pages, products and custom post types, with categories, tags, custom fields and author;<\/li>\n<li><strong>comments<\/strong> (without IP addresses) and the <strong>media library<\/strong> list with file addresses.<\/li>\n<\/ul>\n\n<p>Because the password hashes are included, your application can check a user's usual password exactly like WordPress does (phpass for older accounts, bcrypt for WordPress 6.8 and later), then store it in its own format at the first sign-in. Nobody has to reset their password.<\/p>\n\n<p><strong>Security first<\/strong><\/p>\n\n<ul>\n<li>The file is always encrypted with a passphrase you choose: key derived with Argon2id, content encrypted with XChaCha20-Poly1305 (libsodium secretstream). Without the passphrase the file cannot be read.<\/li>\n<li>The file is streamed to your browser and never stored on the server.<\/li>\n<li>Only administrators can export, and they must type their account password again. Five wrong passwords lock the export for 15 minutes.<\/li>\n<li>The last 20 exports are listed: who, when, how many records, with or without password hashes.<\/li>\n<li>Privacy: the export log stores, for each export, the date, the administrator's username and IP address. It is deleted when the plugin is uninstalled.<\/li>\n<li>Password hashes are optional: untick them for a content-only export.<\/li>\n<\/ul>\n\n<p><strong>Large sites<\/strong>: users and content are read in batches of 200. From the command line: <code>wp newtiv-migrate export site.ntvm<\/code> (see <code>wp help newtiv-migrate export<\/code>).<\/p>\n\n<p>This plugin does not connect to any external service.<\/p>\n\n<h3>File format<\/h3>\n\n<ol>\n<li>First line: <code>NTVMIG1<\/code>.<\/li>\n<li>Second line: a JSON header with the key derivation parameters (<code>kdf.alg<\/code> = argon2id13, <code>kdf.opslimit<\/code>, <code>kdf.memlimit<\/code>, <code>kdf.salt<\/code> in base64) and the secretstream header (<code>header<\/code>, base64).<\/li>\n<li>Then frames: a 4-byte big-endian length followed by the ciphertext of one secretstream message. The last frame has the FINAL tag; a file without it is incomplete.<\/li>\n<\/ol>\n\n<p>Key: <code>crypto_pwhash(32, passphrase, salt, opslimit, memlimit, ARGON2ID13)<\/code>. Decrypted, the frames form NDJSON, one record per line, each with a <code>type<\/code>: <code>meta<\/code>, <code>user<\/code>, <code>term<\/code>, <code>post<\/code>, <code>media<\/code>, <code>comment<\/code>, then <code>end<\/code> with the counts, to check that nothing is missing.<\/p>\n\n<p>Any libsodium binding can read it: PyNaCl (Python), libsodium-wrappers (Node.js), ext-sodium (PHP).<\/p>\n\n<p>User records carry <code>pass<\/code> and <code>pass_format<\/code> (<code>wp-bcrypt<\/code>, <code>phpass<\/code>, <code>bcrypt<\/code>, <code>md5<\/code>, <code>argon2<\/code>). Meta values are exported exactly as stored in WordPress (arrays stay PHP-serialized).<\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin and activate it.<\/li>\n<li>Go to <strong>Tools \u2192 NEWTIV Migrate<\/strong>.<\/li>\n<li>Choose what to export, choose a passphrase (or generate one), type your password, download.<\/li>\n<li>Keep the passphrase somewhere safe, separately from the file.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"can%20someone%20use%20the%20file%20to%20sign%20in%20to%20my%20site%3F\"><h3>Can someone use the file to sign in to my site?<\/h3><\/dt>\n<dd><p>No. A password hash cannot be used to sign in; it can only be used to check a password someone types. And the file itself cannot be read without the passphrase.<\/p><\/dd>\n<dt id=\"i%20lost%20the%20passphrase.\"><h3>I lost the passphrase.<\/h3><\/dt>\n<dd><p>The file cannot be opened. Make a new export.<\/p><\/dd>\n<dt id=\"my%20host%20says%20the%20sodium%20extension%20is%20missing.\"><h3>My host says the sodium extension is missing.<\/h3><\/dt>\n<dd><p>The plugin needs PHP's sodium extension (included with PHP since 7.2, enabled by almost every host). Without it, the export button stays disabled.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>First release: encrypted export of users (with password hashes), content, comments and media list; WP-CLI command; export log.<\/li>\n<\/ul>","raw_excerpt":"Export your users (with their password hashes) and your content to one encrypted file, to move them into a new application without losing anyone.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/387440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=387440"}],"author":[{"embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/newtiv"}],"wp:attachment":[{"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=387440"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=387440"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=387440"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=387440"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=387440"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/srd.wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=387440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}