Tools / Cyber Security Interview Questions
Why do we use Salting in password hashing?
Salting adds a unique, random value to each password before hashing, so that even if two users choose the identical password, their stored hashes come out completely different.
hash("password123" + salt_user1) -> "a1b2c3..." hash("password123" + salt_user2) -> "9f8e7d..."
- Defeats precomputed rainbow table attacks, which rely on matching hashes against a lookup table
- Forces an attacker to crack each password individually rather than all at once
- Costs almost nothing to implement since the salt is simply stored alongside the hash
Modern password hashing functions like bcrypt, scrypt, and Argon2 build salting in automatically, along with deliberately slow computation to further frustrate brute-force attempts.
What attack does salting primarily defeat?
What happens to two identical passwords with different salts?
More Related questions...
