MessageDigest.getInstance with MD5 or SHA-1 uses a broken hash unsuitable for security purposes.
Use SHA-256 or stronger, and for passwords use a KDF such as bcrypt, scrypt, or PBKDF2.