How to securely hash passwords?
I have a website and on that website I use SHA-256 and salt my user's passwords. What I'm doing right now is padding each letter of the user's password with trash data before hashing it. The reason I do this is so if someone happens to get a database dump of my site(unlikely, but possible) brute forcers/dictionary attack tools like john the ripper won't work because the hashed password isn't actually a word from their word lists, but a jumbled version of it.
Is this a viable strategy or is there another way to prevent dictionary attacks? Some users have reported problems with their passwords, which may or may not be related to my "pre-hashing" method, but I was interested in looking into alternatives for hashing passwords. I cannot use blowfish with any secure number of rounds due to the necessity that password hashes calculate in a reasonable amount of time.
Are there any PHP implementations of that new SHA3 Keccak hashing algorithm or would this be a bad idea to use?