This is, btw, the exact construction used in the first result that pops up when you search "how to apply pepper to hash" (https://security.stackexchange.com/questions/21263/how-to-apply-a-pepper-correctly-to-bcrypt) Several of you had the good intuition that concatenation is *fishy*. The folks on SE did not, merely remarking that it is "a tad less elegant, mathematically speaking."