I had done a lot of research about this topic.
I found that some people suggest that to hide salt is not important: https://crackstation.net/hashing-security.htm
But also this article suggests to use keyed hash which you have to hide some kind of key.
From different sources I learned that the best way to hash is using bcrypt.
secret string is random string that created by following code:
User enter the website, we gave him string which contains both secret string and the salt. And we store hashed version of secret string by using the salt but not storing salt.
Next time, user enter the website and copy&paste secret string along with salt and we verify it by hash function using those.
I am able to hide salt via giving it to the user to store it along with secret string. In this case will hacker be able to use brute force attack? What will be advantage of hiding salt?
it is not a password, so user shouldn't remember it, we just need to find a way to prevent attacker to get the original string that website gave to the user