You sound like someone who has never run John the Ripper.<p>There clearly are passwords that are impractical to crack. To get one, just "head /dev/random | openssl sha1".<p>Nobody uses passwords like that. They're irrelevant. Instead, the smart ones use passwords that contain a combination of words, numbers, and punctuation. John the Ripper has been cracking those passwords for over a decade.<p>"Salted hashes" are insecure. They'd have been rejected by the FreeBSD team in 1997. If you choose to make a religion out of not using bcrypt, do what the RFC says and use PBKDF.