[Meller]

Your encryption should be enough, you're using local files, being restricted to your server only, there's no way they're getting leaked unless you're stupid. But, if you'd be stupid, you still have udb_hash(). So it should be enough. I only encrypt my passwords if they're remote, of course I've started encrypting them all the time, but what you got is enough.