What Is Salting a Password?

Understand what a password salt is, why unique salts are used and how salting helps protect stored credentials.

A salt is extra unique data used during password hashing

When a website stores a password securely, it should not store the original password in readable form. Instead, it derives a value using a password hashing process. A salt is unique data incorporated into that process.

Why use a different salt for each password

Without unique salts, identical passwords can produce identical hash values under the same algorithm. That can reveal patterns and make large-scale precomputed attacks more useful. Unique salts reduce those advantages.

A salt is not a secret password

The purpose of a salt is not to hide another secret from attackers. It is normally stored alongside the derived password value. Its value comes from being unique and changing the calculation, not from remaining unknown.

Salting and slow hashing work together

Good password storage normally combines unique salts with a modern password hashing function designed to be computationally expensive. The goal is to make large numbers of password guesses costly.

Do users need to add their own salt?

No. Users should not invent a personal salt and append it to every password as a substitute for proper account security. This is a responsibility of the service storing credentials.