I'm unclear what you mean when you say "and I use two layer sha-2 512 keys with unique salts". The Plain-Text Offenders site is concerned with web sites that c

I'm unclear what you mean when you say "and I use two layer sha-2 512 keys with unique salts". The Plain-Text Offenders site is concerned with web sites that can email you back your original password in plain text. Personally, I'd be most concerned when these emails are in response to an "I forgot my password" request. (Initial registration emails that send you back your plaintext password are dumb, but don't necessarily indicate that the site operator can reconstruct your plaintext password.) If you are physically incapable of reconstructing the user's plaintext password and emailing it back to them then I'd say you're in good shape. If you have enough information to reconstruct the plaintext password then you're doing it wrong.