To store a password securely, you use a hashing algorithm that isn't designed to be fast, i.e. bcrypt. Please read: http://codahale.com/how-to-safely-store-a-pa

To store a password securely, you use a hashing algorithm that isn't designed to be fast, i.e. bcrypt. Please read: http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/. Giving advice and in general debating about a specialized topic like crypto is a touchy business. With specialized topics in general, those without deep domain knowledge typically get things wrong. And in a topic like crypto, wrong advice can have significant negative consequences for those that follow it. The reason why Thomas is taking you to task on this one is that your original post talks about secret salts. That's a big red flag that there is a lack of understanding of underlying, fundamental security principles.