This is silly, true, but "you are not a cryptographer, use bcrypt" is not helpful. You could design an equally silly password hashing scheme using pbkdf2 and bc

This is silly, true, but "you are not a cryptographer, use bcrypt" is not helpful. You could design an equally silly password hashing scheme using pbkdf2 and bcrypt, the recommended alternatives: sillysalt(user):=user+date+mersenne_twister() sillykdf(user,password):=pbkdf2(sillysalt($user)+ shuffle(bcrypt($password))) persist( sillysalt($user)+":"+$outer_pbkdf2_salt+":"+ $inner_bcrypt_salt+":"+sillykdf($user,$password)) A scheme like this is designed to thwart offline attacks on the password verifier (for example, an attacker acquires a dump of your database). His user+date+mersenne salt accomplishes the goal of (mildly) increasing the cost of precomputed attacks. He should use a CSRNG instead. He uses existing cryptographic hash algorithms, SHA1 and MD5. His shuffling does not add or detract from the security of the scheme. He does not perform any significant key strengthening. Weak (most) passwords will be very cheap to brute force.