Since nobody has said it yet... don't salt or hash your passwords, and don't parrot the line "salt your hashes" because it's a massive oversimplification and th

Since nobody has said it yet... don't salt or hash your passwords, and don't parrot the line "salt your hashes" because it's a massive oversimplification and the easy/naive way is wrong. Hashes, cryptographic hashes included, are designed to be fast. Unfortunately, that means that they're also fast to brute force. Use bcrypt[1] or a proper key derivation function[2] like PBKDF2[3] [1] http://en.wikipedia.org/wiki/Bcrypt http://en.wikipedia.org/wiki/Bcrypt [2] http://en.wikipedia.org/wiki/Key_derivation_function http://en.wikipedia.org/wiki/Key_derivation_function [3] http://en.wikipedia.org/wiki/PBKDF2 http://en.wikipedia.org/wiki/PBKDF2