Skip to main content
1 of 2
Relaxed
  • 1.7k
  • 14
  • 10

Others have commented on the proper use of salts and passwords but maybe it's useful to add a word on hash functions because your question seem to suggest a somewhat incorrect intuition of the way they work.

By design, a good cryptographic hash function should not let you guess how similar the inputs were based on the hashed values themselves. Otherwise, it could be inverted by some sort of gradient descent algorithm which would be much less costly than pure brute-force guessing. So hash(salt1 + “12345”) should not be more similar to hash(salt1 + “67890”) or to hash (“12345”) than to hash(salt2 + “67890”).

The whole point of the salt is making sure that the inputs (and hence the hash) are not identical even if two accounts happen to use the same password but similarity should not be an issue.

Relaxed
  • 1.7k
  • 14
  • 10