Salt

Salt, in security, is a random extra value added to a password before hashing, so that the same password gives a different code on every account.

Salt: A salt is a random piece of data added to each password before it is hashed. Because every account gets its own salt, two people with the same password end up with different stored codes. This stops attackers from using ready-made tables of common hashes.

Without salt, an attacker who steals a database can look up common passwords in a pre-computed list and crack many accounts at once. With salt, they must attack each account separately, which takes far more time and effort. It is invisible to you, yet it is a sign of a well-built service. A well-built service adds a new random salt each time, and stores it next to the hash.

Salt does not rescue a weak password. A very short or common password can still be guessed quickly, even if it is salted. That is why a long passphrase and a different password for every site still matter, and why a leak at one service should make you change that password everywhere you used it. This is a good example of protection you never see but still benefit from.

Tips

• Do not rely on a site's salting; use long unique passwords yourself.
• Change reused passwords after any breach notice.
• Avoid common passwords like names, phone numbers and dates, which fall quickly.

Related terms