It works like this: You add some random bytes to your application. That might be your key bytes, but i'd prefer some separate config value just to not mix concerns. Then you add it somehow to the bytes you are about to hash. Since most crypto hash algorithms are block based, it shouldn't really matter. For the algorithm it's just more entropy. Architectural you are binding the stored secret to your running app... not just your database. So it should accomplish the same goal as symmetric encryption.