In short, for passwords, never use a hash function. Hash functions are made to be fast. If you absolutely must use a hash function, iterate it a few thousand

In short, for passwords, never use a hash function. Hash functions are made to be fast. If you absolutely must use a hash function, iterate it a few thousand times. Ideally, use http://www.tarsnap.com/scrypt.html http://www.tarsnap.com/scrypt.html (made to be computationally annoying to brute force).