But wait. What if I use a <i>64 bit salt</i> and then AES-encrypt the password with a key I store half on my server and half in a cookie I send to the user and then they'd have to <i>break AES</i> to get my passwords? How about <i>that</i>, Coda Hale?