you are viewing a single comment's thread
view the rest of the comments
[–] 26 points 1 week ago (2 children)

That is a deep cut. Also: you need to pepper it too.

  • source
  • hideshow 2 child comments
  • [–] 5 points 1 week ago (1 child)

    Salt: something static across the whole app

    Pepper: something dynamic for each user

  • source
  • parent
  • hideshow 1 child comment
  • Other way around. Salt is different for each user, and generally stored along with each user's password hash. Pepper is the same for all users, and therefore can be stored separately from the user/PW database (and hopefully more securely), making the user/PW database useless to anyone who doesn't also get access to the pepper value. See the explainer that schipelblorp@sh.itjust.works linked: https://www.baeldung.com/cs/password-salt-pepper

  • source
  • parent