Martijn Yes and no. MD5 is a hashing algorithm, not a key derivation function. Using it for passwords is (basically) wrong no matter what. MD5 is also no longer considered collision proof and people don't need to find your strong password, just something that results in the same hash. That combined wth a consumer graphics card doing 200 million hashes an hour... MD5 and SHA1 are both considered cryptographically broken. PBKDF2 is relatively easily to implement and I think is still acceptable even with MD5/SHA1 hashing algorithms (though don't quote me on it). Probably the best you can do on PHP 5.2 unless you include some bigger library.