LearnViz CompSci
Home / Learn / Security & Cryptography / Salting

Beginner Topic 4 of 51 Security & Cryptography

Salting

Adding random data to hashes to defeat precomputed attacks.

How it works

A salt is a random value, unique for each password, that is combined with the password before hashing and stored alongside the hash. It ensures that two users with the same password get different hashes and defeats precomputed rainbow tables, forcing attackers to attack each hash separately. Salts are not secret and should be at least 16 bytes from a cryptographically secure random generator. A pepper is a separate secret kept outside the database.

Step-by-step walkthrough

  1. A user picks a password.
  2. The system generates a random salt for that user.
  3. It hashes the password together with the salt.
  4. It stores the salt and hash.
  5. Identical passwords now produce different hashes, defeating rainbow tables.

Where it is used

Password storage libraries such as bcrypt, scrypt and Argon2 generate and embed salts automatically in their output string.

Common pitfall

Reusing one global salt or using predictable values like usernames weakens the protection. Salting does not make weak passwords strong or slow down hashing by itself, so combine it with a slow algorithm. Do not invent your own scheme; use a vetted library and verify with constant-time comparison.

Where it fits in the course

Salting is topic 4 of 51 in Security & Cryptography, rated Beginner. It follows Passwords and Hashing. The next topic is Multi-Factor Authentication.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is Salting?
Adding random data to hashes to defeat precomputed attacks. It belongs to Security & Cryptography and is a beginner-level topic.
Where do people use Salting?
Password storage libraries such as bcrypt, scrypt and Argon2 generate and embed salts automatically in their output string.
What is the most common mistake with Salting?
Reusing one global salt or using predictable values like usernames weakens the protection.
What should I learn before this topic?
Start with Passwords and Hashing, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Salting hard to learn?
It is a Beginner topic, so it works as an entry point. If the terms are new, read the explanation twice and try the visualizer before the quiz.
How long does it take to learn Salting?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Salting?
Passwords and Hashing, Multi-Factor Authentication, Threats and Vulnerabilities are closely connected. The full list is in the related topics section of this page.
What should I study after Salting?
Continue with Multi-Factor Authentication, the next topic in Security & Cryptography.

Related topics