What is a salt in password hashing?
A salt is random data added to each password before hashing so identical passwords hash differently. Learn why salts defeat rainbow tables.
A salt is a unique random value added to each password before it is hashed. It ensures that two users with the same password get completely different stored hashes, and it defeats precomputed "rainbow table" attacks.
Why salting is essential
Without a salt, identical passwords produce identical hashes, so an attacker can precompute the hashes of common passwords once (a rainbow table) and crack every matching account instantly. A per-user random salt makes every hash unique, forcing the attacker to attack each password separately — vastly slower.
Salt plus a slow KDF
Salting alone is not enough because fast hashes can still be brute-forced. Modern password storage combines a unique salt with a deliberately slow key-derivation function — bcrypt, scrypt, or Argon2 — which store the salt alongside the hash automatically. Never use a plain fast hash like SHA-256 for passwords.
Try it now — free, no signup
Use the hash generator in your browser. Then, when you need it at scale with an API key and higher limits, grab the full Eveses API.