>This assumes you use a secure hash function, like not md5.

There is no practical preimage attack against MD5, it would work fine in this case.