In cryptography, a salt is some random data used as an additional input to a one-way function that hashes a password or pass-phrase. It makes dictionary attacks more difficult.

Without a salt, it is much easier for attackers to pre-compute the hash value using dictionary attack techniques such as rainbow tables to crack passwords.

Use a long random salt of at least 32 bytes then use the combination of password and salt to hash a password or password phrase.

The following example shows two ways of hashing. In the 'BAD' cases, no salt is provided. In the 'GOOD' cases, a salt is provided.

  • DZone: A Look at Java Cryptography
  • CWE: CWE-759: Use of a One-Way Hash without a Salt