It seems you use too small set of words? I can't see the source on this device, but it looks so.
Secret salt would have to be the same everywhere. So it has no sense to think about it. Just a good hash is needed, hard enough not to be brute forced, like scrypt.
Re:Visualizing hex bytes with Unicode emoji
by neftaly on Tuesday November 04, 2014 @04:34PM
(#8559163)
You only need ~4k words for 2 bytes-per-word alphanumeric encoding (keyspaceLength^bytesPerWord). There is a "special" dictionary identifier prefix and a padding indicator postfix, however (mostly for dev purposes).
Scrypt would probably be fine, though the addition of a secret salt (wouldn't need entropy, just secrecy) would be much better. On reflection, XOR would be stupid bad :B
To prevent a similar-looking-fingerprint attack, you could just re-hash the fingerprint with a secret salt before displaying. I wonder if XOR'ing the fingerprint against a plain hash of itself could also be difficult enough?