Long story short, if you find yourself adding security features (for instance, peppers) to cryptographic tools that don’t accept them as clearly-labeled inputs, talk to a cryptographer first.

Concatenating raw inputs is virtually never going to be the solution they’ll give you.