What it means
A cryptographic hash is designed to be one-way and resistant to collisions. Password systems should not store plaintext passwords or use fast general-purpose hashes alone. A password-hashing function deliberately consumes time and memory so each guess is expensive.
How it works
A salt is a unique, nonsecret random value stored with each password hash. It prevents identical passwords from producing identical stored values and defeats shared precomputed tables. A pepper is an additional secret value stored separately from the password database, often in a secrets manager or hardware-protected service.
Two users choose the same password. Unique salts make their stored hashes different. If the database is stolen, an attacker must guess each salted value; a separately protected pepper can add another barrier until that secret is also compromised.
Practical focus
- Use a modern password-hashing function with reviewed cost parameters
- Generate a unique cryptographically random salt for every credential
- Store any pepper outside the password database and plan rotation
- Rehash credentials when algorithms or cost settings become inadequate
Common mistakes
- Using encryption instead of password hashing without a clear need
- Reusing one salt for every user
- Hard-coding a pepper in the same application package or database
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: