# Fast hashes (MD5, SHA-1, SHA-256) for passwords

*Shortcuts that trade away safety*: one of the ways AI coding agents bloat software, from lessloc's [pattern catalog](https://lessloc.org/patterns/index.md). lessloc catches it as [`unsafe`](https://lessloc.org/guide/reference.md#tier-1): bcrypt, scrypt or argon2.

## What makes fast hashes (MD5, SHA-1, SHA-256) for passwords a bad practice?

The standard that calls it a bad practice: [CWE-916](https://cwe.mitre.org/data/definitions/916.html) Use of Password Hash With Insufficient Computational Effort.

## What does lessloc do about fast hashes (MD5, SHA-1, SHA-256) for passwords?

lessloc catches it as [`unsafe`](https://lessloc.org/guide/reference.md#tier-1): bcrypt, scrypt or argon2.

- `unsafe` (tier 1): A shortcut that trades away safety: SQL built from values, HTML built or escaped by hand, `Math.random()` for secrets, a fast hash for passwords, certificate checks turned off, text run as code.

## Examples

Caught as `unsafe`:

```python [cm.py]
import hashlib


def store(password):
    return hashlib.sha256(password.encode()).hexdigest()
```

Written well:

```python [cm.py]
import bcrypt


def store(password):
    return bcrypt.hashpw(password.encode(), bcrypt.gensalt())
```

## Related patterns

Hand-written versions of what the platform does safely. They are short, which is why agents reach for them. The other patterns in [Shortcuts that trade away safety](https://lessloc.org/patterns/index.md#shortcuts-that-trade-away-safety):

- [SQL built from values instead of query parameters](https://lessloc.org/patterns/sql-from-values.md): lessloc catches it as `unsafe`: pass values as query parameters.
- [HTML built or escaped by hand](https://lessloc.org/patterns/html-by-hand.md): lessloc catches it as `unsafe`: use `textContent` or the framework's rendering.
- [Math.random() or random for tokens and passwords](https://lessloc.org/patterns/weak-randomness.md): lessloc catches it as `unsafe`: `crypto.randomUUID()`, `getRandomValues()` or the `secrets` module.
- [Certificate checks turned off](https://lessloc.org/patterns/tls-off.md): lessloc catches it as `unsafe`.
- [Running text as code: eval, exec, new Function](https://lessloc.org/patterns/eval.md): lessloc catches it as `unsafe`: parse the input instead.