How passwords and logins work: why a website should not know your password
Password salt: why two people with the same password get different hashes
Two people choose the same password. A well-built website keeps two completely different hashes for them. A small random string makes the difference. Because of it, a thief must crack each account on its own.
-
1
Before grinding your password, the website now makes up a string of random characters just for you, x7Qp, and mixes it in. This string is called a salt.
-
2
The salt is no secret. The website keeps it in plain sight, in your row, right next to the hash.
-
3
Nora, another member, also picked sunflower7. She got her own salt, Lm2e, so her hash looks nothing like yours. Nobody reading the list can tell that you two share a password.
-
4
At login, the website takes the salt from your row, mixes it with what you type, and grinds again. Same salt, same password, same hash: you are in.
-
5
Rono's ready-made tables now find nothing: they were made without your salt. And one guess no longer tests every member at once. To try 123456, he must grind it with your salt for your row, then with Nora's salt for hers, and so on, 5,000 times.
-
6
So Rono guesses one member at a time. Still, his computer has a graphics card, a part built to make huge numbers of small calculations at once: billions of guesses a second. How long would your password last?
-
Quick check
Quick check.
Show the answer
No. Their salts differ, so their hashes differ. He has to grind 123456 once with each salt.
-
Go further
Two names that go with salt.