Picking an Auth Library

[eluser]TheFuzzy0ne[/eluser]
I see. OK, now that makes more sense to me. It just adds another layer of security, but it's not totally unhackable. It just compliments the rest of the security measures you have in place.

Thanks for clearing that up for me.

Just out of interest, does anyone here actually use a password that doesn't contain words? I use two words, one of which isn't in any dictionary, and a combination of numbers. It's 26 characters long in all, but if they password was revealed in plain text with a salt added to it, it would be obvious.

But let's say for example, my password was bkldoiugaofesfp and it had a salt on the end of it, again just as random, that would only leave strlen($password . $salt) possibilities. which kind of brings us back to where we started. I guess at the end of the day, the smart thing to do might be to keep your password database on another server. Although this does make things a little more difficult for the developer, it does mean that there is a list of passwords, but no usernames to go with it, unless the would-be hacker had the contents of both databases.