Storing passwords: salt and cost
Why identical passwords must not give identical hashes, and why a password hash should be slow on purpose.
| User | Stored hash: SHA-256(password) | Lookup table |
|---|
accounts cracked instantly 0 / 6shared hashes 0
Real SHA-256, computed in your browser. aysel and cavid have the same password, so they have the same hash, and so do dilara and fidan. A table of hashes of common passwords cracks 0 accounts without any work.
What to notice
- Without salt, users with the same password share a hash, and precomputed tables crack the common ones instantly.
- A salt makes every hash unique, but it does not slow down guessing. Only the cost of the hash does.
- Use Argon2id (RFC 9106) or, where it is not available, bcrypt or PBKDF2 with a high iteration count. Guess rates here are rough figures for one modern GPU.