If a md5 is one way and supposedly unable to be reversed why do we still have large data breeches with user names and passwords. Are these companies storing passwords in plain text?


MD5 is oneway, but it's considered weak today. The main issue is collision attacks, which has been demonstrated.

However, md5 sums can be computed very fast using specialized hardware and GPUs, in the area of billions of hashes per second, so brute forcing md5 hashes are viable today. In addition, without salts, look up tables works perfectly well.

Password hashing functions should be more resource intensive, and algorithms such as PBKDF2 are much better suited for securely storing passwords.

In short, md5 should not be used for storing passwords, and password storage should employ salts.

Not the answer you're looking for? Browse other questions tagged or ask your own question.