ok, here's how I do it (this is in turn stolen from a framework I use). generate a random salt concatenate the salt and password and hash them up then I take

ok, here's how I do it (this is in turn stolen from a framework I use). generate a random salt concatenate the salt and password and hash them up then I take a known array of integers the same length as my salt and slice the salt into the password hash using the integers as offsets and store the result. For password comparison that salt can then be extracted using the same offset array. I've found this to be a great trade off: if the array of integers is kept safe it is next to impossible to attack the stored "key". If the offset is known someone else can extract the salt: but because each person has an individual salt it still invalidates any table based attacks on the hash. There might be theoretically more secure schemes: but I think this one has the best tradeoff of simplicity and security! (the original method comes from the KohanaPHP framework's example auth module by Woody Gilk)