Linked Questions

21 votes
1 answer

Password hashing : Using 2 salts [duplicate]

I'm developing an authentication service. I know the practice of generating a unique salt per user, stored in the DB with the hashed password, to prevent rainbow tables attacks. I just had the idea ...
IggY's user avatar
  • 378
5 votes
1 answer

Global salt vs salt-per-password [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? Any risk in using the same salt for several hashes on a user? It's known that all password hashes need to be salted, ...
Kos's user avatar
  • 1,478
5 votes
1 answer

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I will ...
Aust's user avatar
  • 159
4 votes
1 answer

Is it a good idea to use two salts? [duplicate]

Is it a good idea to use two salts? This is implying that one would be unique to the user, and one would be unique to the server, using Bcrypt of course. So for example, if you're using Golang as ...
Belthian's user avatar
5 votes
2 answers

Hashed passwords storage: iterations vs entropy [duplicate]

Context: A website is hosted on multiple dedicated servers. There are frontend webservers, backend DB servers and other servers between them. The DB holds user's accounts passwords. All connections ...
HashDoe's user avatar
  • 53
6 votes
2 answers

PKCS#5 Salt privacy? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? In the official documentation of the PKCS5 V2.0 standard, we can read "The salt can be viewed as an index into a large ...
Normand Bedard's user avatar
2 votes
1 answer

php's password_hash with system wide salt [duplicate]

I'm thinking about using password_hash function for generating password hashes. I have read that own salts shouldn't be generated and instead use the default one that the function generates. Own salts ...
Buksy's user avatar
  • 123
2 votes
3 answers

Password Security: Encrypting salt [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? I'm new to security and trying to understand why encrypting or hiding a salt is not considered useful. I've read the ...
Usman Mutawakil's user avatar
941 votes
11 answers

How to securely hash passwords?

If I hash passwords before storing them in my database, is that sufficient to prevent them being recovered by anyone? I should point out that this relates only to retrieval directly from the database,...
AviD's user avatar
  • 73.1k
620 votes
7 answers

How to store salt?

If you expect to store user password securely, you need to do at least the following: $pwd=hash(hash($password) + salt) Then, you store $pwd in your system instead of the real password. I have seen ...
George's user avatar
  • 6,387
664 votes
4 answers

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
Sam Saffron's user avatar
  • 6,725
94 votes
10 answers

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
jazzpi's user avatar
  • 1,059
66 votes
7 answers

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
PenumbraBrah's user avatar
80 votes
4 answers

Why add username to salt before hashing a password?

I have seen examples of password hashing that were: H(username + salt + password). What is the purpose of adding username? Is there any purpose?
JustinLovinger's user avatar
43 votes
9 answers

Is salting a hash really as secure as common knowledge implies?

I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things. A salt is an extension added to a password and then hashed, meaning the password is stored in ...
Thomas Andreè Wang's user avatar

15 30 50 per page