What Is Salting, and Why Passwords Need It

A salt is unique, random data added to a password before it is hashed. Its purpose is to make every stored hash unique, even for identical passwords, so that attackers cannot reuse precomputed results. Salting is the difference between a stolen password database that resists cracking and one that falls in minutes.

What attack does salting stop?#

Without salts, the same password always hashes to the same value. Attackers exploit this with rainbow tables — enormous precomputed maps of common passwords to their hashes. Steal an unsalted database, look up each hash, done. Salting breaks this completely: because each password is combined with a different random salt before hashing, the same password produces a different hash for every user, and no precomputed table can match.

	Unsalted hashes	Salted hashes
Same password → same hash?	Yes	No
Rainbow tables work?	Yes	No
Crack all users at once?	Yes	Must attack each separately

How is salting done correctly?#

The rules are simple and non-negotiable:

• Unique per password — never a shared salt; that partially reverts the benefit.
• Random and long — generated from a cryptographically secure source.
• Stored with the hash — salts are not secret; their job is uniqueness, not secrecy.
• Paired with a slow hash — use bcrypt, scrypt, or Argon2, which salt automatically.

Salting is one piece of secure password storage, which builds on hashing vs encryption. More at the Security Fundamentals hub.