Yep, salt. Also, there are much better options than MD5. I used bcrypt in systems I built a while back. There's also scrypt and argon2, which are newer. (Just be careful that you don't create a DoS vulnerability while hardening your login system...)