Home/ Questions/Q 8007565
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-04T17:52:16+00:00

So far I have been using md5 to hash passwords on my site, no

  • 0

So far I have been using md5 to hash passwords on my site, no salt.

Now I am building an application that will have to be more secure and I’m reading md5 can be easily brute-force attacked.

So I want to use crypt() to hash the passwords.

What I have not fully understood is:

  1. Do I have to provide a salt or is the built-in generated one ok?
  2. How many times (if more than one) should I iterate the crypt function to be safe?
  3. With md5, no matter the length of the input string, the hash was 32-digit. Does crypt return a standard length of hashes too?
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You need to provide a salt, if you want to specify encryption other than DES. Otherwise, you’re good with the default salt.

    You don’t iterate the crypt function yourself, this is done internally with algorithms where it makes sense. Number of iterations is specified via the salt.

    Yes, the hash length of a given hash algorithm is standard; different hash algorithms have different hash lengths, however.

    • 0