 <p>You can protect both your password and your salt.</p> <ol> <li><p>Use SHA256 or higher (2012) and in years to come it must be higher.</p></li> <li><p>Use a different salt for every user. </p></li> <li><p>Use a calculated salt.</p></li> <li><p>Create a 16 to 32 byte Salt and store it in the database, called 'DBSalt'.</p></li> <li><p>Create any old algorithm to manipulate the salt but keep the algorithm only in code. Even something as simple as DBSalt + 1 is useful because if someone gets your database, they don't actually have the correct salt because the correct salt is calculated.</p></li> <li><p>Calculate your password as follows:</p> <p>CreateHash(saltAlgorithm(dbSalt), password);</p></li> <li><p>You can add security by having a list of algorithms that manipulate the DBSalt in different ways. Every time a user changes their password you also use a different calculation against the DBSalt</p></li> <li><p>You can add more security by having these algorithms be stored on web servers external to your system so if your DB and code both get hacked, they still don't have your salt.</p> <ol> <li>You can also increase security by having a before, and after, or both salt and the database alone doesn't provide this information.</li> </ol></li> </ol> <p>There is no end to the "You can increase security by..." comments. Just remember, every time you add security, you add complexity, cost, etc...</p> <p><a href="http://www.rhyous.com/2012/06/18/how-to-effectively-salt-a-password-stored-as-a-hash-in-a-database/" rel="nofollow">How to effectively salt a password stored as a hash in a database</a> </p>