Hey! Thanks for taking the time to write out such a detailed reply. I did read up. A salt needs to be large enough to avoid clashes with other salts in my datab

Hey! Thanks for taking the time to write out such a detailed reply. I did read up. A salt needs to be large enough to avoid clashes with other salts in my database and the algorithm needs to be slow enough to calculate that it's impossible for hackers to crack but fast enough that it doesn't bog my site down. Right? I picked sha because it's fast to compute. The idea behind the level of security I'll get is that it is trivial to provide and in the occurrence of a data leak, it will require a non-trivial effort to get any plaintext passwords out. Any less than this and the hacker just needs to dump the data on the internet and my users will immediately be SOL. I think I over-thought the performance bit though. Sign-ups and sign-ins are not a regular enough event to be too much of a performance issue. Thanks again!