DataTerminology.comNEW
Also known as: Hash – Salt
A hash computed over input plus a unique random salt, thwarting precomputed attacks and identical hashes for identical passwords.
DESCRIPTION
A salted hash appends or prepends random, per-record salt to input before hashing, ensuring identical inputs produce different hashes. Salts defeat rainbow tables and complicate brute-force attacks by forcing per-salt computations. For passwords, salts should be long, random, and stored alongside the hash. Modern practice favors memory-hard password hashing algorithms (bcrypt, scrypt, Argon2) that include salts and work factors. Salting does not replace authentication or encryption; it mitigates offline cracking risk.
ALTERNATIVE DEFINITIONS
Wikipedia
In cryptography, a salt is random data that is used as an additional input to a one-way function that ‘hashes’ data, a password or passphrase.
Defines salt and its role in hashing passwords and data.
OWASP
A salt is a unique, randomly generated string that is added to the password before it is hashed.
Emphasizes uniqueness and randomness of salts for password storage.
RELATED TERMS
Password Hashing Key Derivation Function bcrypt scrypt Argon2 Rainbow Table Nonce
COMPETING TERMS
Unsalted Hash Peppered Hash
KNOWLEDGE AREAS
Data Security Data Privacy & Compliance Testing & Validation
TARGET AUDIENCE
Cybersecurity Engineer Security Architect Chief Information Security Officer Software Developer IT Auditor
EXTERNAL SOURCES
- Wikipedia - Salt (cryptography)
- IETF RFC 9106 - Argon2 password hashing specification
- USENIX - Argon2 design and analysis paper
- OWASP - Best practices for salts and hashing
TOP QUESTIONS
Why is a Salted Hash necessary for passwords?
It defeats precomputed rainbow tables and prevents identical passwords from sharing the same hash, raising the effort for attackers.
Category: Relevancy
How long should a salt be in a Salted Hash?
At least 16 bytes of cryptographically secure randomness is common; longer is fine and cheap.
Category: Requirements
Should salts be secret in a Salted Hash?
No. Salts are typically stored with the hash; secrecy is not required, uniqueness is.
Category: Misunderstanding
What’s the difference between a Salted Hash and a Peppered Hash?
A pepper is a secret value stored separately, while a salt is per-record random and not secret.
Category: Comparison
Which algorithms are recommended for Salted Hash of passwords?
Use bcrypt, scrypt, or Argon2 with appropriate work factors; they incorporate salts and slow hashing.
Category: Recommendation
What is a common mistake with Salted Hash implementation?
Reusing salts or using predictable salts; both undermine protection and aid attackers.
Category: Mistakes
Does a Salted Hash prevent brute-force attacks?
It slows them by removing economies of scale, but strong, slow hashing algorithms and good passwords are still necessary.
Category: Risk
How are salts stored in a Salted Hash scheme?
Alongside the hash in the database, often encoded in a standard format string.
Category: Management
How to migrate to Salted Hash from legacy unsalted hashes?
Rehash on next successful login or force reset, storing new salted hashes with modern algorithms.
Category: How-to