What's the benefit of a random salt when it has to be stored in the database table? If someone gains access to the table, they have the salt. Maybe if you just used another field instead of having a salt field, the hacker would not know that the field had anything to do with the salt (user's email address, for instance). Also, does it really matter what you use to hash passwords with? Unless they have direct access to your database, a brute force attack would be done using actual dictionary words, not hashed words. Your site should not allow someone to fail more than a few login attempts before they're locked out for a short time and you log their info. El Forum Guest #00 00-00-0000, 00:00 PM [eluser]Dregond Rahl[/eluser] 