diff --git a/customize.dist/application_config.js b/customize.dist/application_config.js
index 05d4356bb..949c612ee 100644
--- a/customize.dist/application_config.js
+++ b/customize.dist/application_config.js
@@ -40,5 +40,17 @@ define(function() {
     //config.enablePinLimit = true;
     //config.pinLimit = 1000;
 
+    /*  user passwords are hashed with scrypt, and salted with their username.
+        this value will be appended to the username, causing the resulting hash
+        to differ from other CryptPad instances if customized. This makes it
+        such that anyone who wants to bruteforce common credentials must do so
+        again on each CryptPad instance that they wish to attack.
+
+        WARNING: this should only be set when your CryptPad instance is first
+        created. Changing it at a later time will break logins for all existing
+        users.
+    */
+    config.loginSalt = '';
+
     return config;
 });
diff --git a/www/common/credential.js b/www/common/credential.js
index 39ca69fe7..432cc0511 100644
--- a/www/common/credential.js
+++ b/www/common/credential.js
@@ -1,6 +1,7 @@
 define([
+    '/customize/application_config.js',
     '/bower_components/scrypt-async/scrypt-async.min.js',
-], function () {
+], function (AppConfig) {
     var Cred = {};
     var Scrypt = window.scrypt;
 
@@ -20,9 +21,14 @@ define([
         return isString(a) && isString(b) && a === b;
     };
 
+    Cred.customSalt = function () {
+        return typeof(AppConfig.loginSalt) === 'string'?
+            AppConfig.loginSalt: '';
+    };
+
     Cred.deriveFromPassphrase = function (username, password, len, cb) {
         Scrypt(password,
-            username,
+            username + Cred.customSalt(), // salt
             8, // memoryCost (n)
             1024, // block size parameter (r)
             len || 128, // dkLen