I would go with SHA512, and yes, still salt. It makes the user have to brute force instead of looking up the password in a database. This is how I understand i

I would go with SHA512, and yes, still salt. It makes the user have to brute force instead of looking up the password in a database. This is how I understand it. Bcrypt uses Blowfish. Blowfish is not a hashing algorithm but an encryption algorithm. This meaning, you can encrypt something, and then, decrypt it back to plain text. SHA512 on the other hand is a hashing algorithm which should mean that it's impossible to revert. At the end of the day, everything is crack able through brute force. Just try and make it harder for the hacker. You could also add additional salts to a password, defined in code. Or add the salt after the 2nd character of the users inputted password for example. This however is only handy if a hacker hasnt gained access to your source code but only to your database. Additionally, encrypting your sourcecode where the algorithm is implemented adds an additional security layer. There are tons of ways to make it crazy hard to crack a password.