diff --git a/server/routers/auth_router.py b/server/routers/auth_router.py
index 59d7ba67..2f4eebc9 100644
--- a/server/routers/auth_router.py
+++ b/server/routers/auth_router.py
@@ -673,7 +673,7 @@ async def delete_user(
     import hashlib
 
     # 生成4位哈希（基于user_id保证唯一性）
-    hash_suffix = hashlib.md5(user.user_id.encode()).hexdigest()[:4]
+    hash_suffix = hashlib.sha256(user.user_id.encode()).hexdigest()[:4]
 
     user.is_deleted = 1
     user.deleted_at = utc_now_naive()
diff --git a/src/repositories/user_repository.py b/src/repositories/user_repository.py
index 433685b2..c3f37798 100644
--- a/src/repositories/user_repository.py
+++ b/src/repositories/user_repository.py
@@ -102,7 +102,7 @@ class UserRepository:
             if username:
                 import hashlib
 
-                hash_suffix = hashlib.md5(user.user_id.encode()).hexdigest()[:4]
+                hash_suffix = hashlib.sha256(user.user_id.encode()).hexdigest()[:4]
                 user.username = f"已注销用户-{hash_suffix}"
             if phone_number:
                 user.phone_number = None
diff --git a/src/utils/__init__.py b/src/utils/__init__.py
index eee92399..3c2b8ab5 100644
--- a/src/utils/__init__.py
+++ b/src/utils/__init__.py
@@ -47,7 +47,7 @@ def hashstr(input_string, length=None, with_salt=False, salt=None):
             salt = f"{time.time()}_{uuid.uuid4().hex[:8]}"
         encoded_string = (encoded_string.decode("utf-8") + salt).encode("utf-8")
 
-    hash = hashlib.md5(encoded_string).hexdigest()
+    hash = hashlib.sha256(encoded_string).hexdigest()
     if length:
         return hash[:length]
     return hash