I am storing in my database the user password hash and salt.

I would like to know if putting together hash and salt in the same field is adding complexity to a potential hacker who had access to the database?

Like this:

h:hash and S:salt

And even like this:


Positions of salt octets will be chosen arbitrary, and hash and salt will be reconstructed at runtime.

Is it useful? Or completely useless?

2 Answers 2


Having the salt and the password together is pretty common, bcrypt uses something similar. The hash returned by bcrypt has the following format


About the scrambling, while it may give you some kind of protection against most attackers, it's just adding security through obscurity. As far as the attacker doesn't know how are you scrambling the result it will give some protection, but once the attacker knows that it won't give any protection

In general, security through obscurity is not recommended as the only security layer, but in this case it's an additional one over good password hashing practices (I'm assuming you use bcrypt or some equivalently secure password hashing algorithm). But IMO, a better security improvement can be obtained increasing the cost/iterations of the hashing function used

  • 2
    Concur on the obscurity. There are some hashing-contest people who are extremely good at figuring out all sorts of complex obfuscation. Go simple and strong, or go home. :) Commented Aug 3, 2017 at 18:42

I'd say this is good hardening however not something to rely on.

Proper practises such as using a slow-hash algorithm (bcrypt) and securing your server are much more important.

If somebody has access to your server they can likely work out how the hash and salt are arranged within the string.

If only the strings were leaked, it would be significantly harder to brute force since they would not be valid hashes.

Creative idea though, I like it.

  • 1
    Thanks for the answer, but a I can't upvote any of you because my Reputation is lower than 15...
    – Carl Sagan
    Commented Aug 3, 2017 at 19:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .