Why Password Systems Add a Salt Before Hashing
A salt is a random value assigned to a password before the system hashes it. A hash is a one-way calculation that turns input into a fixed-length result; unlike encryption, it is not meant to be reversed with a key. When someone logs in, the system hashes the submitted password with that account’s salt and compares the result with the stored hash.
The salt is usually stored beside the hash. It does not need to be secret: its job is to make each password’s hash specific to that account, not to conceal the password by itself.
What the Salt Changes for an Attacker
Without salts, two people who chose the same password would have the same hash. An attacker who stole a password database could also use a precomputed lookup table—a collection of hashes for likely passwords—to identify many entries at once.
With a different salt for each account, the same password produces different hashes. A lookup table built for one salt does not directly work for another, so attackers must repeat password guesses for each account rather than reuse one result across the database. Salting does not make a weak password unguessable; it makes large-scale guessing less efficient.
That is why password storage typically pairs unique salts with deliberately slow password-hashing methods. The salt blocks shortcuts based on reused hashes, while the slow calculation makes each guess cost more. If a database is exposed, a common password can still be tested—but it is no longer one precomputed match away across every account.
