Sorry, I still don't understand. Does this assume that all passwords share the same salt, so, not a nonce? Because if each hash has a nonce, I didn't know there was a fast way to brute force a database of those.<p>(Assuming that the developer isn't using md5, of course, but even then I wouldn't expect it to yield a lot of results very quickly.)