For example, on the user registration page, is it safe to tell people "Your password will be stored as a one-way hash using the (whatever) algorithm."
If it is not safe, then your hash function is pure junk, and you should not use it.

In any decent security analysis, it is assumed that the attacker already knows all the software that you are using, because:


There are not so many possibilities.
A lot can be guessed based on application behaviour and output.
An attacker who could get a glimpse at your database might also have a copy of your PHP scripts, and thus knows.
Even in cases where the attacker does not know your hash function, it is very difficult to quantify such lack of knowledge: to what extent does the attacker not know ?
In particular, the attacker may also register as a user, with a password he chooses, and then observe the resulting hash, allowing him to quickly test any potential hash function.


On the other hand, making the used hash function explicit may give you a reputation of "competent site owner" which would bring confidence to technically-inclined customers.
