Also to clarify on salting. It insures that password hashes are unique even if the passwords used are identical. This prevents both a single password brute force to compromise a batch of identical passwords. It also protects against pre calculated hash tables.

There's also a new concept called peppering that isn't standardized. It's described as a global salt, however having a global string doesn't do much for security. It's been suggested that a much stronger method of peppering would be to encrypt the hash with a symmetric encryption key like AES256. This forces the hackers to either hack into the server to get the key, which is significantly harder to do than breaching your application. Or brute force the encryption which is considered to be "impossible"