What is a salt?
A salt is a unique value combined with a password before hashing. It ensures two people with the same password get different stored hashes, which defeats precomputed attacks such as rainbow tables and forces an attacker to crack every account separately rather than all of them at once.
- Topic
- Cryptography
- Also called
- cryptographic salt, password salt
- Reading time
- 1 min
- Reviewed
On this page
Why salts do not need to be secret
Salts are usually stored in plaintext alongside the hash, and that is fine. Their job is uniqueness, not confidentiality. A unique salt removes the attacker's ability to reuse work across accounts. A salt fails if it is reused or predictable across users.
Salt versus pepper
A pepper is a secret value added to every password hash and stored separately from the database, often in application configuration or a hardware module. A leaked database without the pepper is much harder to attack. Peppers complement salts; they do not replace them.
Sources
These primary references support the terminology and current security guidance used in this definition.
