In case any programmers read this, the better procedure, if you want to use bcrypt, is to hash the password with something else first, like SHA512, then feed the output into bcrypt.
to slow down attackers who want to brute force your password hash. At least that was the idea. I guess it also includes the salt stuff built in so that it's harder for implementers to screw up.
Is a 9-order-of-magnitude slow down worth the trouble? I dunno. Maybe.
