Return to Answer

You shouldn't just hash passwords, you should salt them, and add a SlowEquals.

You shouldn't just hash passwords, you should salt them, and add a SlowEquals.

You shouldn't just hash passwords, you should salt them too. Why? Let's imagine you just hash your passwords without a salt. You would end up producing a static output pretty much every single time.

Right. But you compare the hash to the password, and if it matches the salted hash in the database, then it's considered a valid password. You may then allow the user to log in.

You shouldn't just hash passwords, you should salt them, and add a SlowEquals.

Why salt?

Let's imagine you just hash your passwords without a salt. You would end up producing a static output pretty much every single time.

Right. You compare the password to the stored hash, and if it matches the salted hash in the database, then it's considered a valid password. You may then allow the user to log in.

You shouldn't just hash passwords, you should salt them too.

You shouldn't just hash passwords, you should salt them too. Why? Let's imagine you just hash your passwords without a salt. You would end up producing a static output pretty much every single time.

For example, "myDarnPassword" would end up being converted to "aca6716b8b6e7f0afa47e283053e08d9" in md5. At this point, you could create a dictionary attack by yourself. You could automatically generate a database that converts as many random characters, plus dictionary attacks, into a usable database. You'd create a table looks like this:

+-------------------+----------------------------------+
| PASSWORD          |           UNSALTED_HASH          |
+-------------------+----------------------------------+
| myDarnPassword    | aca6716b8b6e7f0afa47e283053e08d9 |
+-------------------+----------------------------------+
| pleaseDontSueMe11 | 0dd395d0ec612905bed27020fb29f8d3 |
+-------------------+----------------------------------+

Then you would select from the database like this:

SELECT [PASSWORD] FROM [TABLE] WHERE [UNSALTED_HASH] = 'aca6716b8b6e7f0afa47e283053e08d9'

And it would return myDarnPassword.

With enough processing power and time, you could create trillions of combinations, and quite easily crack a large number of passwords. At that point, all you really have to do is look it up. And if you've stolen other people's passwords in the past from a database, you can add those, and convert them to md5 hashes.

Salting the hash defeats this attack.