When I read "Bcrypt is known to be a stronger hashing method compared to md5" it is blatantly clear the author have missed the entire point of the phpass librar

When I read "Bcrypt is known to be a stronger hashing method compared to md5" it is blatantly clear the author have missed the entire point of the phpass library. https://www.openwall.com/phpass/ https://www.openwall.com/phpass/ to quote > The approach of using multiple iterations to purposefully increase the computational cost of testing a password The author has shown that a hashing function can be attacked by using a dictionary attack... well, yes, of course. But the library is not inherently weak just because of that. Yes, you can write it in 20 lines of Go but -- you'd need to benchmark the attack against other hashes. Just because the md5() primitive is used as part of the algorithm doesn't make the whole shebang weak. The question always is how long it takes to find clear text which gets hashed to a certain value.