I heard it was good practice to have each user have a unique salt, when I'm hashing a user's password with a salt. My question is, can I make my salt a hash of the user's username? Ex.

$username_hash = hash($username);
$pwd_hash = hash($username_hash + $password);

Would something like that be considered acceptable? And more importantly, secure?


I know I could do

    $pwd_hash = hash($username + $password);

But if I do that it doesn't protect from rainbow tables, although a hash of the username would.

marked as duplicate by Steffen Ullrich, PwdRsch, schroeder Oct 30 '17 at 14:10

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.



Remember that people tend to reuse passwords from service to service. If two systems use your scheme and someone uses the same username and password on both systems, then they will end up with the same hash in both cases.

Salts aren't secret, and technically the randomness requirement on them isn't as strong as what is required for cryptographic keys, it is best to generate them the same what that you would generate keys just to avoid this and other sorts of mistakes that people make when creating salts.

Not the answer you're looking for? Browse other questions tagged or ask your own question.