diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java
index 2edab3eb..cdf6b444 100644
--- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java
+++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysProfileController.java
@@ -3,7 +3,7 @@ package org.dromara.system.controller.system;
 import cn.hutool.core.bean.BeanUtil;
 import cn.hutool.core.io.FileUtil;
 import cn.hutool.core.util.ObjectUtil;
-import cn.hutool.crypto.digest.BCrypt;
+import cn.hutool.crypto.digest.DigestUtil;
 import lombok.RequiredArgsConstructor;
 import org.dromara.common.core.domain.R;
 import org.dromara.common.core.utils.StringUtils;
@@ -92,14 +92,17 @@ public class SysProfileController extends BaseController {
     @PutMapping("/updatePwd")
     public R<Void> updatePwd(@Validated @RequestBody SysUserPasswordBo bo) {
         SysUserVo user = userService.selectUserById(LoginHelper.getUserId());
-        String password = user.getPassword();
-        if (!BCrypt.checkpw(bo.getOldPassword(), password)) {
+        String salt = user.getSalt();
+        String loginAccount = StringUtils.isNotBlank(user.getLoginName()) ? user.getLoginName() : user.getUserName();
+        String oldEncrypted = DigestUtil.md5Hex(loginAccount + bo.getOldPassword() + salt);
+        if (!oldEncrypted.equals(user.getPassword())) {
             return R.fail("修改密码失败，旧密码错误");
         }
-        if (BCrypt.checkpw(bo.getNewPassword(), password)) {
+        String newEncrypted = DigestUtil.md5Hex(loginAccount + bo.getNewPassword() + salt);
+        if (newEncrypted.equals(user.getPassword())) {
             return R.fail("新密码不能与旧密码相同");
         }
-        int rows = DataPermissionHelper.ignore(() -> userService.resetUserPwd(user.getUserId(), BCrypt.hashpw(bo.getNewPassword())));
+        int rows = DataPermissionHelper.ignore(() -> userService.resetUserPwd(user.getUserId(), newEncrypted));
         if (rows > 0) {
             return R.ok();
         }
diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysUserController.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysUserController.java
index 733fd346..d0784cac 100644
--- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysUserController.java
+++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/controller/system/SysUserController.java
@@ -4,7 +4,8 @@ import cn.dev33.satoken.annotation.SaCheckPermission;
 import cn.hutool.core.lang.tree.Tree;
 import cn.hutool.core.util.ArrayUtil;
 import cn.hutool.core.util.ObjectUtil;
-import cn.hutool.crypto.digest.BCrypt;
+import cn.hutool.core.util.RandomUtil;
+import cn.hutool.crypto.digest.DigestUtil;
 import jakarta.servlet.http.HttpServletResponse;
 import jakarta.validation.constraints.NotNull;
 import lombok.RequiredArgsConstructor;
@@ -173,7 +174,9 @@ public class SysUserController extends BaseController {
                 return R.fail("当前租户下用户名额不足，请联系管理员");
             }
         }
-        user.setPassword(BCrypt.hashpw(user.getPassword()));
+        user.randomSalt();
+        String loginAccount = StringUtils.isNotBlank(user.getLoginName()) ? user.getLoginName() : user.getUserName();
+        user.setPassword(DigestUtil.md5Hex(loginAccount + user.getPassword() + user.getSalt()));
         return toAjax(userService.insertUser(user));
     }
 
@@ -237,7 +240,10 @@ public class SysUserController extends BaseController {
     public R<Void> resetPwd(@RequestBody SysUserBo user) {
         userService.checkUserAllowed(user.getUserId());
         userService.checkUserDataScope(user.getUserId());
-        user.setPassword(BCrypt.hashpw(user.getPassword()));
+        SysUserVo existingUser = userService.selectUserById(user.getUserId());
+        String salt = existingUser.getSalt();
+        String loginAccount = StringUtils.isNotBlank(existingUser.getLoginName()) ? existingUser.getLoginName() : existingUser.getUserName();
+        user.setPassword(DigestUtil.md5Hex(loginAccount + user.getPassword() + salt));
         return toAjax(userService.resetUserPwd(user.getUserId(), user.getPassword()));
     }
 
diff --git a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/listener/SysUserImportListener.java b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/listener/SysUserImportListener.java
index 66db5f57..19f5fabc 100644
--- a/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/listener/SysUserImportListener.java
+++ b/zdxt-modules/zdxt-system/src/main/java/org/dromara/system/listener/SysUserImportListener.java
@@ -2,7 +2,8 @@ package org.dromara.system.listener;
 
 import cn.hutool.core.bean.BeanUtil;
 import cn.hutool.core.util.ObjectUtil;
-import cn.hutool.crypto.digest.BCrypt;
+import cn.hutool.core.util.RandomUtil;
+import cn.hutool.crypto.digest.DigestUtil;
 import cn.hutool.http.HtmlUtil;
 import cn.idev.excel.context.AnalysisContext;
 import cn.idev.excel.event.AnalysisEventListener;
@@ -11,6 +12,7 @@ import jakarta.validation.ConstraintViolationException;
 import org.dromara.common.core.exception.ServiceException;
 import org.dromara.common.core.utils.SpringUtils;
 import org.dromara.common.core.utils.StreamUtils;
+import org.dromara.common.core.utils.StringUtils;
 import org.dromara.common.core.utils.ValidatorUtils;
 import org.dromara.common.excel.core.ExcelListener;
 import org.dromara.common.excel.core.ExcelResult;
@@ -34,7 +36,7 @@ public class SysUserImportListener extends AnalysisEventListener<SysUserImportVo
 
     private final ISysUserService userService;
 
-    private final String password;
+    private final String initPassword;
 
     private final Boolean isUpdateSupport;
 
@@ -48,7 +50,7 @@ public class SysUserImportListener extends AnalysisEventListener<SysUserImportVo
     public SysUserImportListener(Boolean isUpdateSupport) {
         String initPassword = SpringUtils.getBean(ISysConfigService.class).selectConfigByKey("sys.user.initPassword");
         this.userService = SpringUtils.getBean(ISysUserService.class);
-        this.password = BCrypt.hashpw(initPassword);
+        this.initPassword = initPassword;
         this.isUpdateSupport = isUpdateSupport;
         this.operUserId = LoginHelper.getUserId();
     }
@@ -61,7 +63,9 @@ public class SysUserImportListener extends AnalysisEventListener<SysUserImportVo
             if (ObjectUtil.isNull(sysUser)) {
                 SysUserBo user = BeanUtil.toBean(userVo, SysUserBo.class);
                 ValidatorUtils.validate(user);
-                user.setPassword(password);
+                user.randomSalt();
+                String loginAccount = StringUtils.isNotBlank(user.getLoginName()) ? user.getLoginName() : user.getUserName();
+                user.setPassword(DigestUtil.md5Hex(loginAccount + initPassword + user.getSalt()));
                 user.setCreateBy(operUserId);
                 userService.insertUser(user);
                 successNum++;