[Inori]

It takes the pass and hashes in md5 (already non reversible but easy to dictionary attack), then takes that and base64 encrpyts it using then bcrypts the base64 encrypt. (Overkill a bit)

Tbh you'd be fine with just password_hash($pass, PASSWORD_BCRYPT);

Again, DO NOT USE MD5 IN PRODUCTION. As I outlined in my post, and as you said here, it's extremely vulnerable and should not be used.