The function in question in CakePHP is DefaultPasswordHasher::hash($password).

I've been going through some CakePHP tutorials: https://book.cakephp.org/3.0/en/tutorials-and-examples/bookmarks/intro.html and https://www.tutorialspoint.com/cakephp/cakephp_configuration.htm. From the latter, I'm seeing one big salt string used for hashing in the Security.salt section.

Is this one salt string used for all users when hashing user passwords? I tried looking through the source code, but didn't have much luck. Maybe I'm missing something, but it seems like using the same salt for all users would defeat the purpose of salting in the first place.

2 Answers 2


DefaultPasswordHasher doesn't use the salt value stored in the configuration, that is only used by the WeakPasswordHasher class, or manual hashing by a developer.

The DefaultPasswordHasher class is a wrapper of the built in PHP password_hash which generates a salt for each password and uses the bcrypt algorithm currently. See https://github.com/cakephp/cakephp/blob/master/src/Auth/DefaultPasswordHasher.php#L47-L53


It would not defeat the purpose of salt. The purpose of salting a password is to ensure that the password hash is not equal if only the algorithm is equal.

That means that if some Hashes password "12345" with Algorithm "A" and it will return "ABCDEF", then if some other person hashes with "12345" with Algorithm "A" he will also get "ABCDEF".

The purpose of salting the Password is that if some do the hashing with many passwords (creating a Rainbowtable) or got some kind of Database exports with unsalted passwords, he will not have the exact same value as password as the salted one.

He must then try to hash the password+salt combination to get the same value as his pre calculated value.

But I accept, this is not the best way to salting the password. That seems more like a hardcoded Pepper to me than an Salt.

  • 1
    The class in question uses password_hash - this answer explains the false premise put forwad in the question rather than explain how DefaultPasswordHasher actually works.
    – AD7six
    Commented May 16, 2017 at 16:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .