Why MD5 (and SHA-256) Are Wrong for Passwords
Fast hashes are reversed with lookup tables; Argon2id, scrypt, bcrypt and PBKDF2 compared.
By the TurantTools Dev team · Updated October 27, 2026 · 3 min read
MD5, SHA-1 and even SHA-256 are fast hashes, which is exactly what you don't want for passwords. A modern GPU can try billions of fast hashes a second, and common passwords are already in lookup tables.
The MD5 of "password123"
482c811da5d5b4bc6d497ffa98491e38
Paste that into a search engine and you'll find the password straight away. Every site that stored plain MD5 hashes has had them reversed like this after a breach.
What to use instead
| Algorithm | Notes |
|---|---|
| Argon2id | OWASP's first choice; tune memory and time cost |
| scrypt | Memory-hard; good where Argon2 isn't available |
| bcrypt | Widely supported; only the first 72 bytes count |
| PBKDF2 | Use when FIPS compliance is required, with a high iteration count |
- Each of these adds a unique salt automatically and is slow on purpose.
- Use your framework's built-in password hasher rather than writing your own.
- Fast hashes are still right for checksums, cache keys and file integrity.