Salt (Password)

A salt is a per-password random value (typically 16+ bytes) concatenated with the password before it hits the hash function. Two users with the same password get two completely different stored hashes, which kills the economics of rainbow tables and prevents an attacker from spotting password reuse across accounts in one stolen database. Salts are not secret; they are stored alongside the hash so the same derivation can be reproduced at verification time. Modern password hashing functions (Argon2, bcrypt, scrypt, PBKDF2) all take a salt parameter and bake it into their standard encoded output, so the application rarely has to handle salts directly.