Try to avoid directly invoking "SHA256" in your own security-related code. good: http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2 goode

Try to avoid directly invoking "SHA256" in your own security-related code. good: http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2 gooder: http://en.wikipedia.org/wiki/Scrypt http://en.wikipedia.org/wiki/Scrypt Maybe avoid using SHA256 with them because of Bitcoin ASICs. If your passwords get leaked in hashed form, even with these, you'll still want to tell your users and advise/force them to change their passwords. Forcing makes more sense if you have 2FA to something not likely to be accessible with their previous password (SMS maybe?)