PHP.net says that md5() and sha1() unsuitable for password?
http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash I'm storing user passwords in a MySQL database in hash form. Does this mean that it is unsafe to do so? If it is, what are my alternatives? The next question in the FAQ you linked to discusses it: How should I hash my passwords, if the common hash functions are not suitable? From the FAQ: The suggested algorithm to use when hashing passwords is Blowfish, as it is significantly more computationally expensive than MD5 or SHA1, while still being scalable. The question following that is about salt. Has been answered many times