If no two users use the same password, then in theory salting the password hash is not needed. How often, in practice, do two users have the same password?
It is frighteningly frequent that many users use the same password. Two years ago, Yahoo lost passwords to half a million accounts. According to the password project, only 77% were unique. These were the most frequent passwords and the number of users who used them:
| Word | Count | +-------------------+ | 123456 | 1667 | | password | 780 | | welcome | 437 | | ninja | 333 | | abc123 | 250 | | 123456789 | 222 | | 12345678 | 208 | | sunshine | 205 | | princess | 202 | | qwerty | 172 |
To their defense, many of these accounts could be throw-away email accounts the owners didn't really care about, but there are likely also a lot of accounts there which are the primary mail accounts capable of resetting the passwords to lots of important services.
A password policy forcing users to use a minimum number of characters and at least one capital letter, lowercase letter, number and special character might prevent a lot of these trivial passwords, but given enough users, you are likely to spot the same "trivial upgrades" to the same weak standard passwords some people tend to use (like
The assumption is already wrong. Even if every password was unique, you'd still need salts.
Without salts, the attacker can go through his list of possible passwords just once, compare the hash of each guess and check if the result matches any of the stored hashes. In other words, the attacker only needs a single calculation per guess. This has nothing to do with whether or not the passwords are unique.
Salts prevent this, because they make it impossible to reuse a calculated hash accross different user accounts. The attacker has to do one calculation per guess and user.
But even if you ignore this for a moment and only look at salts as a way to hide duplicate passwords, your scenario is still unrealistic: It's not enough for the passwords to be unique within your system. They need to be unique accross all systems which use the same hash algorithm. Otherwise, an attacker might find duplicate passwords by comparing your hashes with the hashes of some other application.
Since it's very unlikely that an average user will come up with a universally unique password, you need salts in any case.
The numbers vary from leak to leak, but there are some general trends. For example, in the Adobe leak in 2013, 1.5% of users used "123456" as their password, and 44% of accounts had a non-unique password. In a 2009 leak from RockYou.com, 45% were non-unique.
In short, people aren't very good at picking original passwords.