Every web site handles some passwords, if not others, then administrator's password. Can be very unpleasant experience to let them reach into unwanted hands, so they need maximum protection. What all should be taken care of?
Applying MD5 algorithm raises the level of security, but that is not
enough! It often happens that administrators use a "weak" or often-used
password (most usually used user name and password is the same word - "admin"). On the Net,
there are passwords databases which containing their MD5 hashes (encoded values) too, so if they contain the md5 hash of your password getting very password is easy task.
Even if no database does not contain your password, if it consists only of 3-4 letters, will be relatively easy to find it.
The solution is to increase password. Prior to MD5 conversion add him string that consists of a very broad set of characters (i.e.. "e$f*(@%6&/") so decrypting would take too much time, making it practically impossible.
And finally, to force useing stronger passwords it's possible to require that password consists of small and large letters, digits or contain special characters or to have at least N characters.
Following all of these rules will get yuo a pretty secure password system.
