A GitHub project I recently checked has a flawed security as they're using an unsalted md5() to hash the passwords. I opened a bug and they acknowledged it. However, the transition from md5() to bcrypt would mean that every user would need to log in so the password can be migrated.

So my question is, does using bcrypt over md5() reduce it's security?

// For already logged in users:
if (password_verify(md5($_POST['pass']), $DBHash)) {


In that way, the whole database could be migrated easily, instead of migrating each user individually.

Should there be any other problem besides the fact that PHP might timeout if not handled correctly? (around 1 second for each hash).

  • 3
    1 sec per hash is too much for server side hashing. Makes it trivial to DoS your site. I recommend values between 10ms and 100ms. Commented Nov 22, 2013 at 12:29
  • I was just learning about securing the users but never really about securing my site. That's a great piece of advice, thank you @CodesInChaos Commented Nov 22, 2013 at 12:36

1 Answer 1


Absolutely not. In fact, this is almost the standard procedure for migration from a weak hashing scheme to bcrypt in every project I worked with.

What usually happens is that a flag is set for each user indicating that their passwords use the old scheme, and whenever they login the application uses the backward-compatible login logic. Once the user logs in, you have their plaintext password, and now you can simply take the new password and store it using bcrypt only, the unset the flag. All new users use the new bcrypt-only scheme.

Alternatively, you can go by CodesInChaos's suggestion and stick to the new bcrypt(md5()). While he's indeed correct that there's no security gain, I personally like to keep it bcrypt() only.

  • Why would you prompt users to change the password? You already have the plaintext since the user just logged in. Commented Nov 22, 2013 at 12:31
  • 3
    Personally I probably wouldn't even bother going from bcrypt(md5(pass), salt) to pure bcrypt(pass, salt). There is practically no security gain. Commented Nov 22, 2013 at 12:33
  • I consider the correct answer yours, @Adnan, but only after complementing it with the one from CodesInChaos. Commented Nov 22, 2013 at 12:43
  • 1
    @CodesInChaos (about 1st comment), there's a point as it theoretically could already have been leaked. About 2nd, that was the actual point of my question, if there was any actual gain from using only bcrypt(pass) over bcrypt(md5(pass)) (note bcrypt auto-generates a salt, so it's okay not to pass it). Commented Nov 22, 2013 at 12:46
  • Actually, there is a benefit to using bcrypt(md5()). While MD5 has no practical limit to the input size, bcrypt is limited to 72 bytes, iirc. Chaining the two allows bcrypt to take effectively unlimited password sizes.
    – forest
    Commented Apr 3, 2016 at 6:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .