Salting Your Password: Best Practices? [closed]

Prefix or suffix is irrelevant, it’s only about adding some entropy and length to the password.

You should consider those three things:

  1. The salt has to be different for every password you store. (This is quite a common misunderstanding.)
  2. Use a cryptographically secure random number generator.
  3. Choose a long enough salt. Think about the birthday problem.

There’s an excellent answer by Dave Sherohman to another question why you should use randomly generated salts instead of a user’s name (or other personal data). If you follow those suggestions, it really doesn’t matter where you put your salt in.

Leave a Comment