Another slightly kludgey option would be to generate a second salt for each user, then 2 hash each hashed password in your database. When the user logs in, you

Another slightly kludgey option would be to generate a second salt for each user, then 2 hash each hashed password in your database. When the user logs in, you 4 hash with the original salt and 2 hash with the new one each time. Interestingly, a similar scheme could be used to offload some of the hashing work to the client machine - send the first salt to the client and have them do the 4 hash, then do a serverside 2 hash on the client's result.