They are encrypted in a non bijective way : you cannot decrypt passwords.
To check password, we encrypt password given by user with same method and compare result with stored encrypted value (it is same process as for credit card code)

Thanks for your reply.
For explication : We want to create a new application using informations in the report view (work planned, work imputed...) and use the login/password in the projeqtor database
This is why we want to use the same encryption method.

MD5

MD5

No, not so easy.
it is sha256 encryption of password with extra "salt" (randow key stored on user to reduce brute force attacks efficiency)

$this->password=hash('sha256',$paramDefaultPassword.$this->salt);

How about a future switch to the secure password hashing and verification functions PHP now offers?

https://secure.php.net/manual/en/function.password-hash.php https://secure.php.net/manual/en/function.password-verify.php

This will be significantly more secure, as sha256 hashes are comparatively quickly computed using modern graphics cards, allowing to break even non-trivial salted passwords just by brute-forcing them.

Is there really any interest ?
We are dealing with Project Management Tool, not NSA nor Bank, nor credit card. 👿
Moreover, the passwords are stored in the DB, so best security will be to protect your DB access 😉
And you can also switch to LDAP authentication, or, since V8.1, SSO SAML authentication.