Since nobody has said it yet... don't salt or hash your passwords, and don't parrot the line "salt your hashes" because it's a massive oversimplification and the easy/naive way is wrong.

Hashes, cryptographic hashes included, are designed to be fast. Unfortunately, that means that they're also fast to brute force.

Use bcrypt[1] or a proper key derivation function[2] like PBKDF2[3]

[1] http://en.wikipedia.org/wiki/Bcrypt

[2] http://en.wikipedia.org/wiki/Key_derivation_function

[3] http://en.wikipedia.org/wiki/PBKDF2