It's not enough to just use a global salt. You need to use a random salt for each user, which is stored in the DB. You also need to use an algorithm that take

It's not enough to just use a global salt. You need to use a random salt for each user, which is stored in the DB. You also need to use an algorithm that takes a lot of time - SHA1 and the rest are designed to be fast, on purpose. Use bcrypt or something. (FWIW, PHP has the best batteries-included password functions i've seen in a language. `password_hash` etc just do the right thing. Copy what they do and you'll be ok)