In "olden times" (I guess around the fourth empire), common wisdom was to hash like this:<p>salt = getLongRandomString(); hash = sha256(salt+password); save_in_db = salt+"$"+hash<p>Thus, while you don't publish them, salts aren't "secret". That's based on the assumption that a cracker would have to bruteforce each password in turn, and that takes too much time.<p>But no, you can't re-hash with a new salt without access to the plain-text password. If you could, so could the bad guy :)<p>Disclaimer: IANAC, and if I were building security for mission critical stuff, I'd ask someone who was.