This question already has an answer here:

Quite the simple discussion this one (one would assume):

If I'd hash the email and password, and then hash the hashes, whould this be considered safe enough or would this just be a waste considering you could just salt them both?

What should the salt be, could it be the username-part of the email?

marked as duplicate by AviD Dec 17 '13 at 13:55

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Don't hash the usernames. For passwords, hash them using something like bcrypt or PBKDF2. Read this ASAP for more (also contains example source code).

Not the answer you're looking for? Browse other questions tagged or ask your own question.