Now that I'm waking up some more, I realize 1) you're correct, the salt is stored, but 2) you're using SHA-512 for password hashing, which has been repeatedly d

Now that I'm waking up some more, I realize 1) you're correct, the salt is stored, but 2) you're using SHA-512 for password hashing, which has been repeatedly discussed as a bad idea for quite a while on HN. This is the last I'll say on it: I am genuinely glad that you're trying out a project of this complexity, but you have a responsibility not to give others a false sense of security. If you search HN, you will find plenty of advice and reading material -- restrict this app until you have absorbed more of it. It's not enough that it works; strive to make it work well. [Also, a nitpick just because it's killing me: please replace the entirety of isStringAllowed with a regular expression. \w{5,} would give you alphanumerics plus underscore and check for minimum length. Regexes don't solve every string-oriented problem, but they're a fantastic tool to have in your toolbelt.]