Both MD5 and SHA1 are encryption that are not decryptable.
The correct way to use is:
When something is encrypted in md5 or sha1 it will generate a 128 bit HASH and will usually have 32 hexadecimal digits. Every time the same word is encrypted in md5 will generate the same hash.
The most common ultimation of this form of encryption is only to check the integrity of the data, for example, sometimes you will download some file and they provide the source code and a "checksum" of the code, this checksum you can generate an md5 of the code you downloaded and compare with the one provided by the manufacturer, if they crash you may consider that the code has not been changed and the application does not have any viruses inside it.
It is common to use for passwords, for example, you do not need to know your user’s password, nor is it a good practice to store it in the bank, how can I validate a user in this way?
You store the md5 hash in the database, and when the user tries to log in you take the password that he provided encrypts it in md5 and compares, if you hit them are the same, you just validate a password without knowing what the actual password is.
Since sha1 is practically the same thing, the difference is that it generates a 160bit HASG and can generate a hexadecimal of 40 digits.
Hugs
blz still means that if I take the value of the bank to send to the user it will bring me the correct password?
– Leonardo Costa
MD5 is a one-way hash, you create no way back understood.
– Otto
And both are not encryption, they are just hashes. In fact, the only advantage of hashing the password is that there is no return. No one would need that in a normal application. Suggested reading: http://answall.com/questions/2402/ - In your case, just send a link to make a new password, and when you do, write the old one.
– Bacco