<i>whereas your idea is just some random thing you thought up</i><p>He might also have got the idea from one of tptacek's suggestions not long ago.<p>The difference between doing the iterations and bcrypt is.. well.. not massive in a practical sense. You could do either (if your already MD5'ing passwords once [hmmmm], for example, then it is a quicker solution)