title: Passwords and different types of encryption
body: <p>I know, I know, similar questions have been asked millions and billions of times already, but since most of them got a different flavor, I got one of my own.</p>
  
  <p>Currently I'm working on a website that is meant to be launched all across my country, therefore, needs some kind of protection for user system.</p>
  
  <p>I've been lately reading alot about password encryption, hashing, salting.. you name it, but after reading that much of articles, I get confused.</p>
  
  <p>One says that plain SHA512 encryption is enough for a password, others say that you have to use "salt" no matter what you would do, and then there are guys who say <em>that you should build a whole new machine for password encryption because that way no one will be able to get it</em>.</p>
  
  <p>For now I'm using <code>hash_hmac();</code> with SHA512, plus, password gets random SHA1 salt and the last part, defined random md5(); key. For most of us it'll sound secure, <strong>but is it?</strong><br>
  I recently read here on SO, that <code>bcrypt();</code> (now known as <code>crypt();</code> with Blowfish hashing) is the most secure way. After reading PHP manual about <code>crypt();</code> and associated stuff, I'm confused.</p>
  
  <p>Basicly, the question is, will my <code>hash_hmac();</code> beat the hell out of <em>Blowfished</em> <code>crypt();</code> or vice-versa?</p>
  
  <p>And one more, maybe there are more secure options for password hashing?</p>