[Adrian Schneider]

I don't understand your logic...

You want to prevent hacking by cracking your passwords? Doesn't make sense to me.

Anyway... an md5 hash is a 32char unique (not 100% unique, but close) string using hex numbers. Hashes are one way, so you can't "crack" them, but you can try to find other strings which give you the same hash result (aka a collision). Since the passwords as hashed twice like this:

md5(md5(password) . salt)

it will take a LOT of CPU power to try and find the original password. You'd first to first get all the 32 + salt (3?) character strings that give you the final hash, and then of all of those, you'd have to find all the possible strings that give you the first 32 characters of it.



I think it's safe to say the password storing method is NOT the problem here.