Long story short, if you find yourself adding security features (for instance, peppers) to cryptographic tools that don’t accept them as clearly-labeled inputs, talk to a cryptographer first.
Concatenating raw inputs is virtually never going to be the solution they’ll give you.
I would like to remind readers that the same applies to "salting and hashing". Developers who are not cryptographers should be using an accepted "key derivation function" and not salting or hashing themselves. Examples of KDFs are PBKDF2, bcrypt and scrypt.
That's not to dismiss discussion of how KDFs should be implemented. That's presumably very on-topic for HN. But this shouldn't be confused with best practice in using a KDF. If you're implementing a KDF in your application instead of using a pre-built one, you're probably doing it wrong.