If anything, this proves they are hashing to something like MD5 because the max length on the password column is 32. They're likely using some sort of ORM/decla

If anything, this proves they are hashing to something like MD5 because the max length on the password column is 32. They're likely using some sort of ORM/declarative model that you define validation rules on. It makes sense to set the max length of your password column to the hashes length. It just happens that their forms using the same validation rules as their models/database.