Maybe parentheses around the second conjunct?

Obviously this is with unencrypted passwords.  The methodology is good, but you need `BCrypt` to do some work for you in terms of translation cleartext passwords to hashed passwords.