Salt

A salt is a random value added during password hashing so identical passwords produce different hashes, defeating rainbow tables and same-password detection.

Purpose

To make every user password hash unique even for identical passwords, preventing precomputation and bulk comparison.

Mechanism

Generate a unique random salt (≥16 bytes) per password and hash the concatenation: H(password || salt). The salt is stored alongside the hash (no secrecy needed). On verification, re-hash with the stored salt and compare. Salting forces rainbow tables to be precomputed per user, which is infeasible.

Use cases

Password hash storage
KDF (PBKDF2/scrypt) input
Encryption IV analogy
Token generation

Examples

Input
```
password + random salt
```
Output
```
Unique hash
```
Different per user

Common errors

A global fixed salt (equivalent to no salt): Generate a unique random salt per password

Related terms

A pepper is a server-side secret added during password hashing (unlike a salt, it is globally shared and kept secret), raising the difficulty of offline attacks.

Hash salting is adding a random salt to the hash input so identical inputs produce different hashes, defeating rainbow tables and collision detection.

A rainbow table is a precomputed table improved by Martin Hellman for inverting hash functions, trading space for time in a time-space trade-off to crack password hashes.

PBKDF2 (Password-Based Key Derivation Function 2) is the KDF standardized in PKCS#5 that derives keys from passwords via iterated HMAC, widely used for password hashing and key derivation.

Related tools

PBKDF2 Key Derivation

Derive a key from a password using PBKDF2 (RFC 2898) with Web Crypto API. Free, private, and 100% client-side.

scrypt Key Derivation

Derive a key from a password using scrypt (memory-hard KDF). Free, private, and 100% client-side.

Hash passwords with bcrypt or verify bcrypt hashes. Free, private, and 100% client-side.

References