Skip to content
uencoder

Hash Salting

Hash salting is adding a random salt to the hash input so identical inputs produce different hashes, defeating rainbow tables and collision detection.

Purpose

To make hash outputs unique, preventing precomputation attacks and comparison of identical inputs.

Mechanism

Generate a random salt, compute H(input || salt), and store (salt, hash). On verification, re-hash with the stored salt and compare. The salt need not be secret but must be unique. Used for password hashing, HMAC (though HMAC already embeds a key), and similar scenarios.

Use cases

  • Secure password storage
  • Token generation deduplication
  • Data fingerprint deduplication
  • Precomputation attack prevention

Examples

  • Input 
    pass1 + saltA → hashA; pass1 + saltB → hashB
    Output 
    Same password, different hashes

    Unique salt

Common errors

Salt too short (<16 bytes)
Use at least 16 random bytes

Related terms

Salt
A salt is a random value added during password hashing so identical passwords produce different hashes, defeating rainbow tables and same-password detection.
GLOSSARY
Pepper
A pepper is a server-side secret added during password hashing (unlike a salt, it is globally shared and kept secret), raising the difficulty of offline attacks.
GLOSSARY
Rainbow Table
A rainbow table is a precomputed table improved by Martin Hellman for inverting hash functions, trading space for time in a time-space trade-off to crack password hashes.
GLOSSARY
PBKDF2
PBKDF2 (Password-Based Key Derivation Function 2) is the KDF standardized in PKCS#5 that derives keys from passwords via iterated HMAC, widely used for password hashing and key derivation.
GLOSSARY

Related tools

PBKDF2 Key Derivation
Derive a key from a password using PBKDF2 (RFC 2898) with Web Crypto API. Free, private, and 100% client-side.
TOOL
scrypt Key Derivation
Derive a key from a password using scrypt (memory-hard KDF). Free, private, and 100% client-side.
TOOL
bcrypt Hash
Hash passwords with bcrypt or verify bcrypt hashes. Free, private, and 100% client-side.
TOOL

References