Salting & Hashing🍳

Salting & Hashing🍳

What is salting 🧂?

Salting is the process of adding data into a value before hashed to making the process of identifying similar or identical passwords.

What is hashing #️⃣?

Hashing is the process of converting data into a fixed-length string.

fixed-length: all hashes will have the same length

⚠️Something important to highlight is that hashing is not encrypting; Hashing or encryption depends on what the ultimate goal of that obfuscation is (orginisation regulations are a factor).

Here’s an example:

User 1

(~🐧): echo password | sha256sum

User 2

(~🐧): echo password | sha256sum

The hashed passwords are identical; and that makes sense, they’re the same password passed through the same algorithm. The problem arises when two separate users have the same hashed password and a bad actor gets a hold of these password and they can draw similarities.

Hypothetical scenario of compromised data:

User 1 uses the same password for every-site (not an uncommon thing). One of the sites gets their user-data leaked (also not an uncommon thing) which happens to have User 1‘s raw password stored. Then another site gets leaked that has User 1 and User 2‘s passwords that are hashed (but not salted). It’s as easy as running a grep search and comparing hashes.

Adding a random SALT:

User 1

(~🐧): echo 01anv3password | sha256sum

User 2

(~🐧): echo aKdu4ppassword | sha256sum

From above, adding a random six character SALT changes the hash completely.


  • Salting is the process of adding data into a value before hashing it
  • Salts should be random
  • Hashing is converting data into a fixed-length string
  • Hashing is not the same thing as encryption


Discover more from Coursity

Subscribe to get the latest posts sent to your email.


No comments yet. Why don’t you start the discussion?

    Leave a Reply

    Your email address will not be published. Required fields are marked *