 <p>when creating the hashed password you should use "double" salt</p> <p>Create a salt (random md5 or sha1) then use format something like sha1("--$password--$salt--") and then store hashed password and salt in database. </p> <p>Then, when authenticating you recreate the hash from --$pass--$salt-- string and compare it to the pass stored in db.</p>