@Brendan Today we're programming kids. Kind of an "extreme AI" ;)

@Lior Tal: If they got hold of the password database, I would assume they also got hold of the password checking code (be it scripted, compiled or publicly available). Even in the improbable case they didn't, they could guess the algorithm if they managed to generate and store their own password (known plaintext + digest).

@sofa420: You've missed the point quite thoroughly. Nobody is going to try and find collisions for those hashes that would somehow return the original plaintext, they're just going to run a password dictionary through your algorithm to see if any of them gives them the stored hash. Given that they will have access to your stored salts (they've got your database) all that algorithm does is double the amount of hashing/computing/time needed.