gen-briefly-explain-salting-passwords-and-one-common-misconcepti-87e3

Briefly explain salting passwords and one common misconception about it.

# Password Salting **What it is:** A salt is a unique random string added to each password before hashing. For example, if a user's password is "hello123", you might append a random salt like "x7Kp2mQ9", creating "hello123x7Kp2mQ9" before hashing. The salt is stored alongside the hash in your database. **Purpose:** Salting prevents attackers from using pre-computed hash tables (rainbow tables) to crack multiple passwords at once. Even if two users have the same password, their different salts produce different hashes. ## Common Misconception **"Salting keeps passwords safe if the database is stolen."** This is false. Salting doesn't prevent password cracking—it just makes it slower and forces attackers to crack each password individually. If users choose weak passwords (like "password123"), those hashes can still be cracked quickly through brute force, even with salts. Salting is essential, but it must be combined with strong hashing algorithms (like bcrypt or Argon2) and users choosing strong passwords to provide real security.