"Also, we encrypt user passwords on our servers and we never return a password in the result of any query."<p>Queue a link to _that_ bcrypt article...<p>I wonder if they've got a reason not to only store a hash? And if so, I wonder if they've got infrastructure secure enough to store your users passwords in an apparently retrievable form?<p>(I quite like Mozilla.org's guideline of storing the hashes in he database and the salts in the filesystem, to help ameliorate the consequences of an SQL injection attack...)