User can only login using a salt that he throws at the system. U: ambiate P: pass S: BlueSky --> Server md5(BlueSkypass) and check it, never storing it. Save t

User can only login using a salt that he throws at the system. U: ambiate P: pass S: BlueSky --> Server md5(BlueSkypass) and check it, never storing it. Save two passwords, one for general logins (using your own salt) and one resalted password with the user's own passphrase for the hidden data. Maybe just implement an OpenID or Facebook login or something of that nature? This might be misinformation... I haven't looked at encryption in forever!