Hacker News Reader

Hmm, unfortunately I think Symfony2 runs passwords through 1 round of SHA1 unless a custom password "encoder" is used [1].

Bcrypt and PBKDF2 are not custom, they are part of the framework:

Those were added in Symfony2.2; my last experience was with 2.1. Also, I understand that neither of those is default; one should be.