What others said, but also for very practical reasons. Why roll your own at all since this is an area where lots of FOSS code is already available? I see two br

What others said, but also for very practical reasons. Why roll your own at all since this is an area where lots of FOSS code is already available? I see two broad categories here: your environment already has an scrypt/bcrypt/PBKDF2, so just use that, as you would a regular expressions library or a URL parser; or your environment does not, in which case you should grab the spec for scrypt/bcrypt/PBKDF2 (whichever you think is easiest to implement) and implement it. Inventing your own risks errors, while creating a system that's incompatible with what other systems are doing and does not follow any type of researched security protocol.