java - Hash (with Spring) and salt: is this safe? -

i've spring based web app, came using spring-security-3.0.8 (i know, that's not reason, lol) , find out passwordencoder class. in case i'm using md5passwordencoder, i'm not sure if best implementation.

http://static.springsource.org/spring-security/site/docs/3.0.x/apidocs/org/springframework/security/authentication/encoding/passwordencoder.html

the salt generated securerandom.

the whole code this:

string salt = new biginteger(130, random).tostring(32); user.setsalt(salt); user.setpassword(passwordencoder.encodepassword(user.getpassword(), salt)); db.save(user); 

i don't need big security it's knowledge's sake. :)

(what making salt big hash putting bit 160?)

for improved security might want consider jbcrypt or scrypt. spring security 3.1 supports bcrypt out of box.

further universally valid information can found in post secure hash , salt php passwords.