Password salting, live: same password, different hashes
Two users pick the same password. Without a salt their hashes are identical, so one cracked hash (or one rainbow-table lookup) exposes both. With a unique random salt each, the hashes have nothing in common. Type a password and see it happen. Everything runs in your browser; nothing is sent anywhere.
Without a salt: SHA-256(password)
| User | Stored hash |
|---|---|
| Alice | |
| Bob | |
Identical. An attacker who cracks one hash has cracked every account with that password, and precomputed tables crack common passwords instantly.
With a unique salt: SHA-256(salt + password)
| User | Random salt (stored) | Stored hash |
|---|---|---|
| Alice | | |
| Bob | | |
Completely different. Each hash must be attacked separately, and precomputed tables are useless because they'd need a table per salt.
In real systems
SHA-256 is used here only to make the effect visible. Real password storage should use a slow, salted algorithm built for passwords, such as Argon2id, bcrypt or PBKDF2, which generate and store the salt for you. Read the full guide to salting →