You can't do a join because the hash table contains only hashes - nothing to relate them back to the user record. This idea uncouples the password from the use

You can't do a join because the hash table contains only hashes - nothing to relate them back to the user record. This idea uncouples the password from the username and salt, which seems a good idea. But assuming you have access to the database, the additional work required is an indexed lookup instead of a simple equality - not actually a huge deal. Having said that, when it comes to security I'll defer every time to someone with real chops in this area. Wake me up when Bruce Schneier comments on this.