What is salt and password hashing from a developer's perspective?

Password hashing is a fundamental security requirement when designing any web applications and databases. When a user registers in the system, the application must not store their original password in plain text. Instead, a one-way mathematical function is used, which turns a text string into a unique set of characters of a fixed length. This process is called hashing, and theoretically reversing it back to the original string is impossible.

However, traditional hashing is vulnerable today to attacks using pre-computed tables of possible combinations, known as rainbow tables. To protect user data from such attacks, developers use salting. Salt is a random sequence of characters that is uniquely generated for each specific user and combined with their password before computing the hash.

As a result, two different users who set the same password will get completely different hashes in the database due to the uniqueness of the salt. To implement this protection, regular fast algorithms like MD5 or SHA-256 cannot be used, since modern GPUs are capable of brute-forcing them billions of times per second. Instead, specialized slow key derivation and hashing functions should be used.

Such recommended algorithms include Argon2, bcrypt, and PBKDF2. They intentionally slow down the hash calculation process, making brute-force attacks economically unviable for attackers. When designing a database, a developer also needs to allocate sufficient field volume to store the hash itself, algorithm parameters, and the generated salt.

The correct implementation of credential storage looks as follows.