I would use bcrypt but it's not available as a encryption option for the realms in Apache Tomcat. One possibility would be to write an own realm but it's not that easy. Plus additional work is needed to update existing hashes, currently I therefore use salted MD5-hashes.