Hate to keep doing this to you† but you don't need anything like NaCL to solve that problem; just use bcrypt. Every development environment has a bcrypt.

Good example of a flaw mitigated by NaCL: the CBC padding oracle attack.

† Caveat: no I don't