I usually use this function for password generation. var generatePassword = function(username, password){ var passwordData = {} passwordData.salt = hash(hash(username) + (new Date()).valueOf()) passwordData.password = hash(passwordData.salt + hash(password)) return passwordData } Yes, 4 hashes may be overdoing it. But this way even if they find a collision for the hashed password, chances that they'll actually find the plaintext version are slim.