I have been searching around and I am still unsure of what a "salt" is and how to use/implement it. Sorry for the noobish question, I am self learning php.


I am definitely not an expert, but the really short answer is that "salting" a line of text means to stick a few extra characters on the end of it. You could salt "salt" with "abcdefg" to get "saltabcdefg". This might be useful if "salt" happens to be a password that you'd like to make more difficult to guess.

Typically, the password+salt are transformed ('hashed') by some difficult-to-reverse process into a completely different string. This transformed string is then stored as the password, together with the plaintext of the salt, and the original plain text of the password proper is tossed away. When you want to check that someone has input the correct password, you combine whatever they've typed in with the salt that's listed in the password file and then hash the result. If the result matches the password hash you have on record, then you know that they've put in the right password.

Implementing a salt can be as easy as picking a string to serve as the salt and then making sure you keep track of it. But, you could vary the salt with each password, and then you'll have to have a way of keeping track of password+salt combinations as well as generating the variations. Of course, you'll probably also want to hash the password rather than saving the password's plain text, and so you'll have to pick a hash function. At this point, the problem has proceeded from salting proper to implementing a password security scheme.

For PHP, you might want to look at how some of the frameworks have implemented this. Two quick links, for CakePHP and Zend, respectively:



  • Also, if the salt is stored in the database (Different for each user) im guessing that it needs to be hashed along with the password. Whats the best way to get the hashed salt back from the db to test it vs. the stored pw? Thanks – Drewdin Apr 7 '11 at 18:54
  • My impression is that the salt is stored as plain text. Hashing the salt along with the password would effectively require the user to type the password+salt in. However, having the salt in plain text is not so bad, because its primary purpose is to make it harder for people to attack password files with large tables of precomputed "this hash equals this password" values (i.e. rainbow tables). In other words, sure, an attacker could try to modify their approach based on the salt, but they would still have to recompute things from scratch. – Approximately Linear Apr 7 '11 at 23:22
  • CakePHP article on webarchive, zend seems to be gone for good =( – user8554766 Nov 22 '17 at 7:30
  • PHP's password_hash() function adds salt automatically... geeksforgeeks.org/how-to-secure-hash-and-salt-for-php-passwords – Elijah Mock Apr 16 '20 at 13:46

When I first asked this question, many years ago, I was asked in response, "What does salt do for food?" The answer is that it adds variety to food. The idea behind cryptographic salt is that it's something you add to the end or beginning of a string in order that two passwords that are identical don't hash to the same cryptographic value.

Consider this - if I had a password that was really common, like 'hello123', and then it hashed to the exact same cryptographic hash as all other 'hello123' passwords, couldn't I just look in the list of hashed passwords to see who else had the same cryptographic hash, and use my password on their account?

  • 2
    Thanks, does the SALT change or stay the same? – Drewdin Apr 7 '11 at 17:00
  • The reason i ask is wouldn't the same password with the same salt hash the same way? I'm going to read the links that were provided. Thanks – Drewdin Apr 7 '11 at 17:05
  • 5
    The same password with the same salt will hash the same way, yes. Some folks do per-user salts for added security. Even a shared salt dramatically increases security though - the chances of someone having a pregenerated list of salted hashes for your particular salt is small. – ceejayoz Apr 7 '11 at 17:09

A salt is a (short) string that is added to the string you want to encrypt or hash. An Example:

 $password = 'abcdefg';
 $salt = 'anythingyouwant_';
 $pw_hash = md5($salt.$password);

This adds security to the hash, as it's unlikely that "anythingyouwant_abcdefg" is already stored in a hash-database ( http://en.wikipedia.org/wiki/Rainbow_tables )

  • But still 'abcdefg' can be easily guessed, so, no salt will help. – Your Common Sense Apr 7 '11 at 17:21
  • Of course it can be guessed. The salt is only helping if the hash is exposed (for example if i get access to your database with user login credentials). If i know the hash for 'abcdefg' (which isn't hard to guess), i can start looking for this hash in your database. But as I don't know the salt you are adding, i won't be able to find the corresponding password. – stlvc Apr 7 '11 at 19:06
  • How come you know hash but don't know salt? – Your Common Sense Apr 7 '11 at 19:24
  • 1
    There are certain passwords that are often used by users, like "applejuice", "abcdefg", "ball" etc. You can simply hash those passwords for yourself, so you got the hash of these passwords. The salt however is added to those passwords by yourself, so only you know the salt. – stlvc Apr 7 '11 at 19:29
  • if the hash is exposed, the salt is most likely being exposed too. So, no salt will help weak password. – Your Common Sense Apr 7 '11 at 19:37

Well its in the comments, thanks ceejayoz


A salt is something you add to a string before you hash it, it adds another layer of security to passwords and the like.

  • No idea why this was downvoted, it's a perfectly valid answer. – GordonM Apr 7 '11 at 17:09
  • And Im giving you a +1 just because you should be one vote up thanks to Gordon :) – Cogicero Apr 7 '11 at 17:11

Let us spice up things a little by combining several algorithms for hashing, making a double hashing algorithm:

$password = "myPassword";
$salt = sha1(md5($password)).'k32duem01vZsQ2lB8g0s'; 
$password = md5($password.$salt);

As you can see, we first hashed the password using double hashing algorithm (md5 and sha1) and concatenating with a key created salt value. After that, we combined real password with generated salt value and hashed it again with md5. The advantage is that this way alt value is random and it changes, making it nearly impossible to break. I mean, if you can wait for a million years and have a super computer on your hands, try to break it.

  • 1
    Sorry to say it, but you did nearly everything wrong here. MD5/SHA1 is ways too fast, use a slow hash function like BCrypt or PBKDF2 instead. The salt looses its advantage at all, if it is derrived from the password itself, there is not a single bit more randomness in it. The password used in the example, hashed with this algorithm, would be cracked within seconds with a decent cracker tool. If you are interested, then have a look at my tutorial about safely storing passwords. – martinstoeckli Apr 19 '14 at 17:50
  • Tutorial was very clear and Thx for your clear explanation. If we add our own key concatenation then cracking possibility will decreases to narrow I hope.-@martinstoeckli – Mahendra Jella Apr 21 '14 at 7:05
  • If you add the key this way, you add a pepper, this is an improvement because an attacker now needs privileges on the server. Though it doesn't make the salt any safer, if is still not random and if the attacker knows the pepper, it is still derrived from the password. Furthermore there is a better way to add a server side secret, have a look at the last part of the tutorial about encrypting the hash. – martinstoeckli Apr 21 '14 at 13:07

For some reason. Salts are usually hard for people new to cryptography to grasp. Once it clicks though, the concept is extremely simple. Have a look at this article. I think it explains the concept better than most.


Your Answer

