3 ms·

Of course, hashing _and_ expiration would be best. I'm not really seeing any good reason _not_ to expire them...