Wirebook

Wirebook › Glossary › Salt

What is a salt in passwords?

In one sentence: A few random characters mixed into a password before it is fingerprinted, different for every person, so identical passwords look different.

A little more

When a website stores a password fingerprint (a hash), it first mixes in a salt: a short string of random characters made just for that account. The salt is stored next to the fingerprint; it isn't secret.

Because every account has its own salt, two people with the same password end up with completely different fingerprints. A thief who steals the database can't crack everyone with one guess or use ready-made tables, and has to start again for every single person. Salting is combined with deliberately slow recipes such as bcrypt or Argon2.

See it in action

  1. 15How does a website check your password without keeping it?Make up a password, store it on three pretend websites (plain text, a plain fingerprint, salted and slow), then let a thief steal all three.8 min · interactive

Related words

← All 146 words