2007+: web apps move to phpass phpass is an easy to use PHP password hashing class phpass would use bcrypt if available (CRYPT_BLOWFISH in PHP), and if not then fallback to BSDi-style extended DES-based hashes (CRYPT_EXT_DES in PHP), with "a last resort fallback to MD5-based salted and variable iteration count password hashes implemented in phpass itself (also referred to as portable hashes)" phpass has started to see some adoption by major web apps (WordPress, phpBB3, and Drupal) in 2007, which has helped further adoption Not surprisingly, many of them chose to force the use of the "portable hashes", which unfortunately make less efficient use of the server's CPU phpass was originally written during a security audit of an Openwall client's "web app" in 2004 in response to the findings (so that they could replace their weak password hashing). It was released publicly in 2005.