The default password encryption in Drupal 6 is MD5. Is it right? I want to change it to something more difficult like crypt and sha1.

Is there any module for this purpose, or do I have to hack the core myself?

1 Answer 1


Yes, you can look for the Secure Password Hashes module.

This module stores password hashes securely.

The default password hashes in Drupal 6 (and before) are rather insecure. MD5 is easy to crack, should an attacker find a database dump or gain access to your database. This module implements secure password hashes using the phpass password hashing method - multiple rounds of hashing and salting that make reversing the hash significantly more difficult to break by brute-force attack. This is the same approach that is used for Drupal 7.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.