Understanding Password Hashing
Password hashing is fundamental to modern security, but choosing the wrong algorithm can leave your users vulnerable. This guide explains when to use different hash types and why our password hash generator includes algorithms you shouldn't use for passwords—along with what you should use instead.
The Purpose of Hashing
Hashing transforms input into a fixed-length string that appears random. The same input always produces the same hash, but you can't reverse the process to recover the input. This makes hashing perfect for password verification: store the hash, and when users log in, hash their input and compare. Even if attackers steal your database, they get hashes—not passwords.
The critical distinction is between fast hashes (MD5, SHA family) and slow hashes (bcrypt, Argon2). Fast hashes were designed for speed—verifying file integrity, creating checksums. Slow hashes were specifically designed for passwords, intentionally consuming more resources to resist brute force attacks.
Why MD5 and SHA Are Dangerous for Passwords
Modern GPUs can compute over 10 billion MD5 hashes per second. A password that would take centuries with bcrypt falls in minutes with MD5. SHA-256 and SHA-512 are cryptographically stronger but just as fast, making them equally unsuitable for passwords.
Additionally, MD5 and SHA-1 have known collision vulnerabilities—two different inputs can produce the same hash. While this doesn't directly enable password cracking, it undermines trust in the algorithm. SHA-256 and SHA-512 remain collision-resistant but should still never be used for passwords due to their speed.
Appropriate Uses for These Algorithms
SHA-256 and SHA-512 remain excellent choices for file integrity verification, digital signatures, blockchain applications, and HMAC constructions. MD5 and SHA-1 should only be used for legacy compatibility. If you're building anything new, use SHA-256 or better for checksums, and bcrypt or Argon2 for passwords.
For WordPress sites, the platform uses phpass with multiple rounds—slower than plain SHA but not as secure as bcrypt. If you're working with WordPress, use the appropriate phpass-compatible hash generation for compatibility. For custom applications, always choose bcrypt with appropriate work factors.
Best Practices for Developers
Always use established libraries for password hashing—never implement your own. Most languages have built-in bcrypt support. Always salt passwords (bcrypt does this automatically). Use appropriate work factors that make hashing take 0.5-1 second on your hardware. Test password strength and enforce sensible password policies to reduce reliance on hashing strength alone.
Remember: even the best hash can't save a password like "password123". Use our password generator to create strong passwords, then hash them properly. Security is defense in depth—strong passwords combined with proper hashing provide the best protection.