First off: I do not, nor intend to, use a home brew hash functionality, ever. I'm aware why one shouldn't do that and have read enough topics about it to know it's foolish to do.
I understand that I am no expert at the subject and that those who are could find and abuse a vulnerability in my own made algorithm and could use those conclusions to break my stored hashed passwords more easily than a more robust standard encryption.
The thing I cant wrap my head around is the following: If you assume a function which you put A in, always outputs B, where B is always the same. I'm aware that that's not the best, but please take that as is as an 'proper' algorithm for comparison.
If a hacker has a database, does its thing and managed to restore an amount of passwords from it. If they have a bot running, or download/generic hack/buy some hashed passwords, the hacker can repeat the standard tricks to reverse them.
If I own a insignificant enough company not to get targeted specifically by hackers and implement my own 'extra sauce'1, all the 'driveby' variants of using tricks no longer work and thus would be safer.
Is there/what is the flaw in my logic? Long them this would be a worthless aproach, becasue what if you do get bigger? Just do it right from the beginning. But what if you know you'll never be.
1e.g. I split the string in parts A & B, and concat them BAB.