# What is a salt?

> A unique value mixed into a password before hashing so that identical passwords produce different hashes.

Last reviewed: 2026-09-01

## Salt

Category: Cryptography

Also called: cryptographic salt, password salt

Canonical page: https://moolkey.com/glossary/salt

A salt is a unique value combined with a password before hashing. It ensures two people with the same password get different stored hashes, which defeats precomputed attacks such as rainbow tables and forces an attacker to crack every account separately rather than all of them at once.

### Why salts do not need to be secret

Salts are usually stored in plaintext alongside the hash, and that is fine. Their job is uniqueness, not confidentiality. A unique salt removes the attacker's ability to reuse work across accounts. A salt fails if it is reused or predictable across users.

### Salt versus pepper

A pepper is a secret value added to every password hash and stored separately from the database, often in application configuration or a hardware module. A leaked database without the pepper is much harder to attack. Peppers complement salts; they do not replace them.

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.