⚠️ Security Warning:
MD5 is not secure for password hashing and should only be used for compatibility with legacy systems. Consider migrating to
bcryptorargon2for secure password storage.
If you are working on a Laravel application using Filament Admin and you already have users table with passwords are stored as MD5 hashes, Laravel makes it possible to register a custom hash driver so authentication still works.
In this article, we will learn how to develop custom hash driver for legacy systems, which can use Filament Admin.
Step 1 – Create the MD5 Hasher Class
Laravel’s hash drivers only need three methods: make, check, and needsRehash. We’ll create a simple MD5-based hasher class as follows:
namespace App\Hashing;
class Md5Hasher
{
public function make($value, array $options = [])
{
return md5($value);
}
public function check($value, $hashedValue, array $options = [])
{
return md5($value) === $hashedValue;
}
public function needsRehash($hashedValue, array $options = [])
{
return false;
}
}In this hasher class, we used md5 function to encrypt the data.
Step 2 – Register the MD5 Driver in AuthServiceProvider
We need to register this hash driver class to the app/Providers/AuthServiceProvider file as follows,
namespace App\Providers;
use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider;
use Illuminate\Support\Facades\Hash;
use App\Hashing\Md5Hasher;
class AuthServiceProvider extends ServiceProvider
{
public function boot()
{
$this->app->make('hash')->extend('md5', function() {
return new Md5Hasher;
});
}
}Step 3 – Set Laravel to Use MD5 by Default
After register to the service provider, we need to change the authentication driver for laravel. You can do it from .env file or config/hashing.php file.
In .env:
HASH_DRIVER=md5Or in config/hashing.php:
'default' => env('HASH_DRIVER', 'md5'),Step 4 – Ensure Passwords Are Stored as MD5
When creating or updating users, Laravel will now use MD5 automatically:
use Illuminate\Support\Facades\Hash;
use App\Models\User;
$user = new User();
$user->name = 'Admin';
$user->email = 'admin@example.com';
$user->password = Hash::make('secret'); // stored as MD5
$user->save();How It Works in Filament
Filament uses Laravel’s built-in authentication (Auth::attempt()), which in turn uses Hash::check(). Because we overrode the hash driver, Filament logins will automatically work with MD5 passwords.
Bonus: Supporting Both MD5 and bcrypt
If you’re migrating from MD5 to bcrypt, you can check both formats:
public function check($value, $hashedValue, array $options = [])
{
if (md5($value) === $hashedValue) {
return true; // MD5 match
}
return password_verify($value, $hashedValue); // bcrypt/argon
}This way, old MD5 passwords still work, but you can rehash them to bcrypt on the next login.
Final Thoughts
- Use MD5 only for compatibility with old systems.
- If possible, rehash MD5 passwords to bcrypt or argon2 after the first successful login.
- Filament will automatically use your custom MD5 logic since it relies on Laravel’s authentication system.
