> a separate hash for each mask If someone steals a hash for characters 1-4 they'll be able to brute force it. Only 10000x the cost of a single login. And then

> a separate hash for each mask If someone steals a hash for characters 1-4 they'll be able to brute force it. Only 10000x the cost of a single login. And then if you have the hash for characters 2-5...