Password Salting

Salting is the practice of adding a unique random value, called a salt, to each password before hashing it. The salt is stored next to the hash. Because every user has a different salt, two users with the same password end up with completely different hashes.

Salting defeats rainbow tables, which are precomputed lists of hashes for common passwords, and forces attackers to crack each password separately. Modern password hashing algorithms such as bcrypt, scrypt and Argon2 generate and store the salt automatically. A pepper is an extra secret value kept outside the database, such as in application settings.