Need to resist the temptation Please resist the temptation to customize password hashing in your own web application or the like It is too easy to get it wrong Having too many different password hash types in active use is undesirable Difficult to migrate hashes between systems Existing password security auditing tools are not immediately usable, so administrators of individual installs of your app won't be able to audit the security of their users' passwords Yet a determined attacker will implement this, then distribute the tool to others Further research, experiments, discussions within the community are needed - to arrive at as few next generation KDFs as practical