So basicly using AES instead of md5 is what your saying. Though what your doing with the plaintext that is encrypted is iin effect adding a salt that actualy a

So basicly using AES instead of md5 is what your saying. Though what your doing with the plaintext that is encrypted is iin effect adding a salt that actualy allows easier brute forcing as it does not compliment the the encryption but offers a fixed point ability to verifiy that you have broken the password. Also AES256 isn't imune from being brute forced, not nth bit encryption is imune. But remember that any password used on the web is only as good as the transport layer used to convey it and in that you could have the best encryption in the world, but when it is entered via a http connection in plaintext it becomes moot and when it is via https, then it is down to the encryption used for that connection. Security is often the longest path to the weakest link and that sadly is still a weak link - some call them users, some call them bad passwords and some just call them and ask them for there passwords! Summary: you have taken the salt aspect and made it a public cleartext password whilst at the sametime removing the extra entropy it affords. You could probably get a job at Linkedin though as you have done better than they did.