This question already has an answer here:
I heard it was good practice to have each user have a unique salt, when I'm hashing a user's password with a salt. My question is, can I make my salt a hash of the user's username? Ex.
$username_hash = hash($username); $pwd_hash = hash($username_hash + $password);
Would something like that be considered acceptable? And more importantly, secure?
I know I could do
$pwd_hash = hash($username + $password);
But if I do that it doesn't protect from rainbow tables, although a hash of the username would.