Mozilla is using an interesting approach to password security with their web apps (coded in Django): http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-

Mozilla is using an interesting approach to password security with their web apps (coded in Django): http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-password-storage/ http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-pa... tl;dr Keep secret key on app server (ie on different server than database), hash it and password with HMAC-SHA256, then hash that with bcrypt for storage in database. Secret key is in a dictionary which allows you to can change the key periodically and deprecate old or questionable keys.