Salted Hash (Passwords)

A salted password hash is a safer way to store password verifiers than keeping passwords in readable form. A salt is random data unique to a password record. When the password is processed by an appropriate password-hashing algorithm, the salt makes identical passwords produce different stored outputs and frustrates precomputed password lookup attacks. The salt itself usually does not need to be secret.

A developer should use a well-maintained authentication library with a slow password-hashing algorithm such as Argon2id, scrypt, or a suitably configured alternative. General-purpose fast hashes, including unmodified SHA-256, are not designed to make password guessing expensive. The implementation must also manage updates, rate limits, reset procedures, and account compromise risks; salting alone is not a complete authentication defense.

Imagine an online booking portal where two users choose the same weak password. Their independently salted password verifiers should differ, but either account can still be vulnerable to guessing if its password is weak or the login endpoint lacks abuse protections. Password hashing differs from encryption: the application verifies a password rather than decrypting the stored value. Website owners using third-party platforms should assess authentication practices and updates instead of trying to write their own cryptographic routines.