Mozilla also uses a 2 server approach for passwords on their web apps but instead of splitting the password, they introduce an initial HMAC hash stage using a s

Mozilla also uses a 2 server approach for passwords on their web apps but instead of splitting the password, they introduce an initial HMAC hash stage using a salt that is stored on a web app machine and then rehash that with Bcrypt for storage in a database on a separate machine. "If an attacker steals one of our password databases, they would need to also separately attack one of our web servers to get file access in order to discover this local salt value. If they don’t manage to pull off two successful attacks, their stolen data is largely useless." http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-password-storage/ http://blog.mozilla.org/webdev/2012/06/08/lets-talk-about-pa... They have an implementation for Django (ignore the project name, it's a legacy name): https://github.com/fwenzel/django-sha2 https://github.com/fwenzel/django-sha2 Their implementation makes it trivially easy to expire HMAC keys and silently upgrade users to new HMAC keys.