It's MD5 with a salt. "Since the hashed password is never exposed outside of our data center, we don’t think that the differences between MD5 and SHA-1 are rel

It's MD5 with a salt. "Since the hashed password is never exposed outside of our data center, we don’t think that the differences between MD5 and SHA-1 are relevant. I.e. the risks for MD5 are about producing two inputs that match the same output. In the case of a purely back-end MD5 hash, any hypothetical attacker doesn’t have access to either the output (the MD5 hash) or the original input (the user’s password and our salt), so there really isn’t any productive attack based on MD5 vulnerabilities. Of course, if someone has your original password and our salt, they might be able to come up with a SECOND synthetic password that hashes to the same value. (Since we constrain password characters that we accept, that might not be possible, but let’s assume it is…) The attacker could theoretically use this second password to access your account. But that same attacker could just use your original password, so I don’t see a real-world attack that would be improved with SHA1. (Before Evernote, I spent five years building high-end cryptographic systems for government customers [e.g. http://www.isto.org/ose-site/file-fix/Public/corestreet-secure-access-control-govt.pdf http://www.isto.org/ose-site/file-fix/Public/corestreet-secu..., so I get to make use of my old crypto knowledge from time to time…)" http://blog.evernote.com/tech/2011/05/17/architectural-digest/#comment-455 http://blog.evernote.com/tech/2011/05/17/architectural-diges...