salt
termcryptographysecurity
Random data added to a password before hashing, unique per user.
Salting means two people with the same password get different hashes, which defeats rainbow tables and makes precomputation useless. It need not be secret, only unique; a secret companion value is called a pepper.
A salt is what stops an attacker from cracking a thousand passwords for the price of one. Without it, identical passwords hash to identical values, so a single precomputed table maps hashes back to passwords across every account and every breached database simultaneously.
Adding a unique random value to each password before hashing destroys that economy. Rainbow tables become useless, because a table would have to be built per salt, and the attacker is pushed back to attacking each account individually. It also hides the fact that two users chose the same password, which is itself a leak worth closing.
The essential thing to understand is that a salt is not a secret. It is stored alongside the hash, in plain view, and the design assumes the attacker has it. Its value is entirely in being unique per record, which is why generating a fresh random salt per password matters far more than protecting it. A pepper, by contrast, is a secret kept outside the database, and the two are complementary rather than alternatives.
Also known as: password salt, salting