I know, I know, similar questions have been asked millions and billions of times already, but since most of them got a different flavor, I got one of my own.

Currently I'm working on a website that is meant to be launched all across my country, therefore, needs some kind of protection for user system.

I've been lately reading alot about password encryption, hashing, salting.. you name it, but after reading that much of articles, I get confused.

One says that plain SHA512 encryption is enough for a password, others say that you have to use "salt" no matter what you would do, and then there are guys who say *that you should build a whole new machine for password encryption because that way no one will be able to get it*.

For now I'm using `hash_hmac();` with SHA512, plus, password gets random SHA1 salt and the last part, defined random md5(); key. For most of us it'll sound secure, **but is it?**  

I recently read here on SO, that `bcrypt();` (now known as `crypt();` with Blowfish hashing) is the most secure way. After reading PHP manual about `crypt();` and associated stuff, I'm confused.

Basicly, the question is, will my `hash_hmac();` beat the hell out of *Blowfished* `crypt();` or vice-versa?

And one more, maybe there are more secure options for password hashing?