Comment by mjau-mjau

md5() is used to hash names for cache, not for anything security related. For login, it uses PHP password_verify()