Disclaimer: I've never done an industrial-class password hash, but the salts you show match my understanding of good practice. Coincidentally this was posted on

Disclaimer: I've never done an industrial-class password hash, but the salts you show match my understanding of good practice. Coincidentally this was posted on HN today, and it takes issue with the hashing method rather than the salt: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/