This comparison of MD5, Bcrypt, and Argon started as internal documentation for my team, but seemed worth sharing with the wider developer community. It's primarily for backend developers and security engineers who want a practical understanding of these hashing algorithms. While not exhaustive, this quantified comparison should give you a good sense of how these approaches differ. The information is readily verifiable through standard documentation.

MD5 vs Bcrypt/Argon

Bcrypt vs Argon

Under the Hood

// Simplified implementation walkthrough for Argon/Bcrypt
const hashPassword() => {
  const workFactor = 12;
  const iterations =  2 ** workFactor;
  const rawPassword = 12345678;
  const salt = library.getSalt(); // returns 128 bit unique string; (can be configured in argon)
  let hashedPassword  = salt + '$' + rawPassword;
  while (iterations) {
    hashedPassword = library.hash(salt, hashedPassword);
    hashedPassword = salt + '$' + hashedPassoword;     
    iterations--; 
  }
	return hashedPassword;   
}      

const comparePassword(rawPassword) => {
  const hashedPassword = db.getHashedPassword();
  const workFactor == 12;
  const iterations =  2 ** workFactor;  
  const salt = hashedPassword.split('$')[0;
  const comparePassword = salt + '$' + rawPassword;
  while (iterations) {
    comparePassword = library.hash(salt, comparePassword);
    comparePassword = salt + '$' comparePassword;
    iterations--;
  }
  return comparePassword === hashedPassword;        
}}

Implementation

Password Storage Flow

graph TD
    %% Entities are rectangles, actions are rounded rectangles/circles
    Client[[Client]]
    Server[[Server]]
    DB[(Database)]
    
    %% Actions are rounded rectangles
    SendHash(Send MD5 Password)
    HashGen(Pass to Hashing Library)
    StoreHash(Store Final Hash)
    
    Client --> SendHash
    SendHash --> Server
    Server --> HashGen
    
    subgraph Library["Bcrypt/Argon2 Library (Automated)"]
        style Library fill:#333,stroke:#666,stroke-width:2px,color:#fff
        HashGen --> InternalProcess(("Hash Generation (Automated salt handling)"))
    end
    
    InternalProcess --> StoreHash
    StoreHash --> DB
    
   note["Note: Salt generation and storage are handled automatically by the library"]
	 style note fill:#D3D3D3,stroke:#000000,stroke-width:2px,color:#000000

Authentication Flow

graph TD 
    %% Entities are rectangles
    Client[[Client]]
    Server[[Server]]
    DB[(Database)]
    
    %% Actions are rounded rectangles
    SendHash(Send MD5 Password)
    FetchHash(Fetch Stored Hash)
    ReturnHash(Return Stored Hash)
    Compare(Pass to Comparison)
    Grant(Grant Access)
    Deny(Deny Access)
    
    Client --> SendHash
    SendHash --> Server
    Server --> FetchHash
    FetchHash --> DB
    DB --> ReturnHash
    ReturnHash --> Compare
    
    subgraph Library["Bcrypt/Argon2 Library (Automated)"]
        style Library fill:#333,stroke:#666,stroke-width:2px,color:#fff
        Compare --> Verification{{"Password Verification (Automated salt handling)"}}
    end
    
    Verification --> |Match| Grant
    Verification --> |No Match| Deny
    
    note["Note: Salt extraction and comparison are handled automatically by the library"]
		style note fill:#D3D3D3,stroke:#000000,stroke-width:2px,color:#000000

Migration Strategy

1. Pick either Argon2 or Bcrypt library (I recommend Argon2 since it's the state of art) - both are easy to implement and work similarly.