Weak Password Hashing Algorithms

High Severity Technical Guide

Vulnerability Description

Storing passwords using legacy, fast hashing algorithms (MD5, SHA1, unsalted SHA256) makes them extremely easy to crack via lookup tables or GPU-powered brute force.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Use modern, adaptive hashing algorithms with high work factors such as Argon2id, bcrypt, or PBKDF2 with high iteration counts.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.