With publicly creatable accounts by the potential hacker, a pepper is just another password.

Leaving identifiable bits in the hash makes it easier to do things like

if pass_type ($1$) { on_logon $upgrade_to_pass_type$6$)

> At worse, you slow them down a bit, allowing you to do things like mass-email everybody affected.

If you ever know at all.

Better to use 'not fast' hashes like bcrypt, scrypt, or PB(something) that requires far more work and far slower cracking.