Laravel Weak Password Hashing: How to Replace md5 and sha1 with bcrypt

The Problem

How to Fix

1. 1

   Find all weak hashing in your codebase

   Search for md5 and sha1 used in authentication or password contexts:

   grep -rn 'md5(\|sha1(' app/ --include='*.php'

   Look specifically for: - md5($password) or sha1($password) - Custom authentication that compares md5 hashes - Legacy database columns with 32-character (md5) or 40-character (sha1) hashes

   Note: md5() used for cache keys, ETags, or non-security purposes is acceptable.

2. 2

   Replace with Hash::make() and Hash::check()

   Use Laravel's built-in hashing:

   use Illuminate\Support\Facades\Hash;

   // Hashing a password
   $hashed = Hash::make($password);

   // Verifying a password
   if (Hash::check($plaintext, $hashed)) {
       // Password matches
   }

   // In a User model / registration
   User::create([
       'password' => Hash::make($request->password),
   ]);

   Laravel's Hash facade uses bcrypt by default with automatic salt generation. You can configure the algorithm in config/hashing.php.

3. 3

   Migrate existing md5/sha1 passwords

   For existing users with legacy hashes, rehash on login:

   // In your LoginController or custom auth logic
   if ($user && md5($password) === $user->password) {
       // Legacy hash matches — rehash with bcrypt
       $user->update([
           'password' => Hash::make($password),
       ]);
       Auth::login($user);
   }

   After a reasonable migration period, force remaining users to reset their passwords.

How to Verify

Prevention

Frequently Asked Questions