title: Is PEAR Auth really a viable option for PHP authentication?
body: <p>Looking at <a href="https://stackoverflow.com/questions/1581610/help-me-make-my-password-storage-safe">How can I store my users&#39; passwords safely?</a>, the best way to encrypt passwords is using phpass. I want to use PEAR Auth package for authentication, but PEAR only supports md5, sha1, sha256, sha512 and PEAR doesn't add a salt to the hash.</p>
  
  <p>PEAR Auth also doesn't support many of the features that are listed in <a href="https://stackoverflow.com/questions/346980/what-codeigniter-authentication-library-is-best/476902#476902">How should I choose an authentication library for CodeIgniter?</a></p>
  
  <ul>
  <li>reCAPTCHA supported</li>
  <li>Activation emails</li>
  <li>Unactivated accounts auto-expire</li>
  <li>Uses phpass for hashing (and also hashes autologin codes in the DB)</li>
  <li>Very reasonable security model around failed login attempts (good protection against bots and DoS attacks)</li>
  <li>"Remember me" functionality</li>
  </ul>
  
  <p>My question is: is PEAR Auth really a viable choice? It seems to use it, I will have to write all the missing features myself. <strong>Is there a better, more feature-rich Auth library that is not wrapped inside a framework</strong>? I just want basic, secure authentication for my simple web app.</p>