md5 is not really much better than plain text (I imagine a few Amazon GPU instances could crack most of the md5 hashes very quickly). bcrypt is the way forward in most cases.