Modern GPUs can calculate 250 million MD5 hashes per SECOND - so even a salted MD5 hash isn't much help. Since you're using Code Igniter, that means PHP -- bcr

Modern GPUs can calculate 250 million MD5 hashes per SECOND - so even a salted MD5 hash isn't much help. Since you're using Code Igniter, that means PHP -- bcrypt forces you to use a salt, plus its a slower hashing method which means the passwords are much more secure should your database ever be compromised. Final not its not "bcrypt or salt" its "bcrypt and salt" -- a salt is a string you add to the plaintext password before hashing, to prevent the use of rainbow tables for an attacker.