Originally Posted by Andrew R I just use md5(). It's the users fault if they use a dictionary word or something (even though, technically, it would be the site owners fault for someone getting in to the database in the first place).

Actually, I know many library's that contain more than just dictionary words. There are many hackers now that even have they're own private database on their computers that just make a php script to randomly generate literally a few hundred thousand strings and enter them into their database along side of the hash. I have also been told there are a few AIM Bots that search a few different libraries and return results from each, this is probably why I'm so paranoid about it as well though. All in all, I'd rather be safe than sorry... Especially over a matter of about 20 characters total.

Anyway, it's late so I'm off to bed. Peace.