I want to know what encryption methods are used by Magento.

Is it simple md5 or salted or SHA? Where can I look into it in detail?

I looked for code for md5 encryption in Mage_Core_Model_Encryption, which is used to encrypt passwords. I can also see encrypt and decrypt. What are they used for? Encrypting user info or something else?


Encryption is done via the Mage_Core_Model_Encryption class.

Hashing runs via the method hash which uses MD5. Not sure why did didn't go with SHA but it should be sufficient.

Encrypting data for later use is done using the encrypt method that use the Varien_Crypt class that by default relies on Mcrypt to do it's job.

Since it uses a factory pattern you can easily use other encryption methods as well in theory by adding a class file in the app/code/local/Varien/Crypt directory.

The Varien_Crypt_Mcrypt class is a wrapper for PHP Mcrypt used to encrypt data with the key given in the local.xml file under node path global/crypt/key. If you want to add your own encryption class you can probably use that class best as an example

  • thanks , i looked code for md5 encryption here "Mage_Core_Model_Encryption" which method is use to encrypt password i can also see encrypt and decrypt for what are they using encrypting user info or ? Mar 3 '15 at 12:43
  • 3
    "Not sure why did didn't go with SHA" - they do in Magento Enterprise (very questionable to intentionally use less secure methods in CE, if you ask me...) Mar 3 '15 at 12:49
  • @fschmengler so thats what $15.000 buys you these days... :P
    – Sander Mangel
    Mar 3 '15 at 12:51
  • @mour passwords are done with the MD5 method and a salt string that is stored separated with a ':' after the password
    – Sander Mangel
    Mar 3 '15 at 12:52
  • 3
    what to do if we want to make it secure Mar 4 '15 at 5:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.