PasswordFactory.getInstance(ALGORITHM_DIGEST_MD5) is called once for each user in the file, each time this is called all registered providers are queried - instead this should be called once and cached.