Salt is adding additional bits to a hash. Although you run across the issue of storing the salt with the hash, it adds a layer of security. Pepper is actually inserting a key within the hash, making it computationally slower to break the hash. A strong hash algorithm is a good defense. Do not enable LM hashing, as this is an old standard (depreciated) for Microsoft machines. Using a 'null' password means you do not use a password or username. Although you would not have any hashes to be broken, you also would leave your system open. <-WHY IS THE PEPPER IS THE ANSWER? - EDIT: I deleted pepper. Some people apparently think they are clever by adding BS answers. This is effectively a DoS attack against people that are serious users of this site.