I'm going to try to save tptacek the trouble of typing it out again: 1. Salt must be per user unique. Do not reuse salt. 2. Do not use md5 or sha* as they are

I'm going to try to save tptacek the trouble of typing it out again: 1. Salt must be per user unique. Do not reuse salt. 2. Do not use md5 or sha* as they are, because they are too fast to compute and thus too easy to brutforce. Instead use a slow hash function, as slow as you can possibly tolerate in your app. E.g. Bcrypt, scrypt, or pbkdf2. These algorithms allow you to tune their slowness. 3. As computers become faster, you will need to make your hash functions slower. Have a plan in place that will allow you to recompute bashes to increase their slowness.