After a quick glance at the code, I noticed the salt is limited to letters only ("qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"), which limits the possi

After a quick glance at the code, I noticed the salt is limited to letters only ("qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM"), which limits the possibilities to 52 per byte instead of allowing 256 values. One can fathom this was done because of a misunderstanding of the need for the hash to be ASCII printable without using hex to encode it. Even so, it could have included numbers and all other printable characters. It uses 16 bytes of salt, but each byte is crippled to roughly 1/5th of the amount of psudo-random bits it can carry. As implemented, this 16 byte salt is equivalent to 3.25 bytes (26 bits) of pseudo-random data (52/256*16). This person at least made their source code available. When you run closed-sourced security-sensitive software, you're just taking the vendor's word for it.