Why Use This Tool?
A salt is random data added to each password before hashing, ensuring identical passwords produce different hashes. Every user needs a unique salt, and each password change should generate a new one. This tool produces cryptographically random salts in your choice of format.
16 bytes (128 bits) is the standard salt size recommended by NIST. The tool generates up to 20 at once — handy when migrating a user database or setting up a new authentication system.
How It Works
- Set the salt size in bytes (16 is standard).
- Choose the output format — hex is most common.
- Generate and copy — store each salt alongside its corresponding password hash.
What Is a Cryptographic Salt?
A salt is random data combined with a password before hashing to ensure that identical passwords produce different hashes. It defeats precomputed rainbow tables because each salt requires its own table.
Common Use Cases
- Password hashing in user databases
- API key derivation
- Encrypted data with unique initialization
- Preventing rainbow table attacks
Frequently Asked Questions
What is a salt in cryptography?
A random value added to each password before hashing. It ensures identical passwords produce different hashes, defeating rainbow table attacks and making brute-force attacks per-user instead of per-system.
What size should a salt be?
16 bytes (128 bits) is the NIST recommendation. Larger is fine but unnecessary — 16 random bytes already has 2^128 possible values.
Should I reuse salts?
Never. Each password should have its own unique salt. If two users share a salt, identical passwords produce identical hashes, which leaks information.
What's the difference between a salt and a pepper?
A salt is stored alongside the hash and is unique per user. A pepper is a global secret added to all hashes and stored separately from the database. Salts defeat rainbow tables; peppers add defense if the database is stolen but the app server isn't.
Tips & Things to Watch
- Store the salt alongside the hash in your database — it's not secret.
- Generate a fresh salt every time a password changes.
- Never reuse a salt across users — that defeats the purpose entirely.
- Bcrypt and Argon22 generate salts internally — you only need this tool for custom implementations.