Right now I'm storing a salt and password_hash on the users table (pretty standard stuff).

The need arose to get a secure hash of another field for a user. Is there any risk in reusing the same salt used on the password? In other words, does using the same salt on several hashes make it easier to crack assuming the attacker had all the hashes along with the one salt? If so how much?


1 Answer 1


The point, and only usage, of the salt is to prevent an attacker from attacking several N elements for less than N times the cost of attacking one. Here, "attacking" means "trying possible values until one is found which matches the known hash value". Without a salt, an attacker could compare his hashed guesses with several hash values, thus sharing the cost of computing the hash; e.g. the attacker has several hash values to attack simultaneously, or the attacker builds a precomputed table of hash values for fast lookup (modulo a space/time swap, both attacks are identical).

If you use the same salt for the password of a user, and for another field, then an attacker could try to attack them both. This will be advantageous for the attacker only if potential values for the other field are also potential passwords, and vice versa. This may or may not apply to your context.

On a general basis, salts should never be reused, if only because consequences of reuse are not easy to detail exhaustively. I recommend that you refrain from reusing your salts.

  • 2
    Thanks this was helpful! I sounds like it's not strictly necessary in my case, but definitely safer to refrain from it in general. Aug 15, 2011 at 1:38
  • 1
    Isn't another possible use prevent attackers from using a lookup table of hashes of common passwords? For example, hash('password' + salt) is more secure than simply hash('password'), because the attacker probably knows hash('password') ahead of time, but does not know the former.
    – BWG
    Aug 26, 2016 at 14:11
  • So it should be OK to reuse the salt when the user changes his password, since the salt is only used by one field at any one time? That would be useful if writing is expensive, e.g. if you're storing your database on punch cards.
    – Fax
    Dec 10, 2019 at 14:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .