When a user registers, a random personal salt is generated. Then hashing is done like so:
hash(hash(USERNAME . PEPPER . PASSWORD) . PERSONALSALT)
Then the personal salt is encrypted using password as key and placed in the database along with hash. When user attempts to log in, personal salt is decrypted, and used to hash and compare. Is this a good idea? The hashing function is SHA-256 iterated roughly half a million times depending on sever specs.
Yes I am aware that "rolling your own encryption" is a mortal sin. I am just wondering hypothetically if it would function. I would never use something made sketchily in a production environment.