No seriously, before you get like a million users you should switch to a much slower hashing alg that's designed for passwords, not for checksums. Scrypt is good, bcrypt is good, and there are a few others. But here's a(n?) scrypt package on Haskell that will do it for you and has a really nicely designed API: http://hackage.haskell.org/packages/archive/scrypt/0.3.1/doc...
Why: http://throwingfire.com/storing-passwords-securely/#notpassw...
2800M/s SHA1 hashes on a ATI HD 7970.
vs
http://stackoverflow.com/questions/11298184/about-how-fast-c...
PBKDF2 is still very much harder to crack then SHA1 with any reasonable length of salt.
http://en.wikipedia.org/wiki/Scrypt
It comes down to this: Why use something which is designed for speed like hashes to do something that can be broken by highspeed guessing?
Perhaps you have hundreds of millions of users? The slower your hash algorithm the more resources it takes to run it.
While you may use better passwords than this, it's certain that some of your users do not.