For example, a person having password 123456.

it's MD5 is e10adc3949ba59abbe56e057f20f883e and SHA1 is 7c4a8d09ca3762af61e59520943dc26494f8941b and after joining both hashes.

Which comes to be e10adc3949ba59abbe56e057f20f883e7c4a8d09ca3762af61e59520943dc26494f8941b, decreases the risk of getting brute-forced?

  • 8
    If the attacker knows your scheme, it will be no stronger than MD5 alone. Use a password hashing method that is known to be difficult to attack, such as bcrypt
    – Owen
    Jul 1, 2016 at 16:06
  • @Owen How can attacker know my scheme when I use PHP to encrypt them?
    – Naman
    Jul 1, 2016 at 16:10
  • 3
    Don't try to make your own "smart-hashing-algorithms", people who have actually studied cryptography and it's complex math, have already done that for you. In most cases even open-source so multiple professional cryptographers have reviewed/improved it. Your implementation indeed won't really help. People will see quickly it's a mix of multiple hash-algorithms: length (MD5: 32 & SHA-1: 40) and a tool like Hash-Identifier will do the rest.
    – O'Niel
    Jul 1, 2016 at 16:14
  • 3
    @NamanSood An untrustworthy hosting company, a former employee, someone who steals your laptop with your source code, someone who guesses your SSH or FTP or other remote access password. Breaches happen to the biggest and best companies. There is no good reason not to use a tried and true password hashing function, especially when PHP has it built in for you. php.net/manual/en/function.password-hash.php
    – Owen
    Jul 1, 2016 at 16:29
  • 1
    @NamanSood maybe you want to improve the quesiton mentioning why you would want to do this and ask if one can suggest a better option. ex, if md5 and sha1 is the best you have availble in your programming environment, re-hashing the md5 with sha1 would be much better.
    – CristianTM
    Jul 1, 2016 at 17:10

1 Answer 1


No, the method you have provided is considered to be security through obscurity or

the belief that a system of any sort can be secure so long as nobody outside of its implementation group is allowed to find out anything about its internal mechanisms.

and generally considered to be a bad idea.

Not the answer you're looking for? Browse other questions tagged .