--- title: "Password salting" description: "Salting adds a random salt to each password before hashing. What the salt does, how it differs from a pepper, and the keys and salts in wp-config.php." language: "en" locale: "en-US" type: "definition" canonical: "https://www.wp-masquerade.com/glossary/password-salting/" published: "2026-10-28T08:00:00+00:00" modified: "2026-10-28T20:11:35+00:00" translations: en-US: "https://www.wp-masquerade.com/glossary/password-salting/index.md" fr-FR: "https://www.wp-masquerade.com/fr/definitions/salage/index.md" es-ES: "https://www.wp-masquerade.com/es/glosario/salt/index.md" de-DE: "https://www.wp-masquerade.com/de/glossar/salting/index.md" it-IT: "https://www.wp-masquerade.com/it/glossario/salt-crittografico/index.md" pt-BR: "https://www.wp-masquerade.com/pt/glossario/salt/index.md" nl-NL: "https://www.wp-masquerade.com/nl/woordenlijst/salting/index.md" --- # Password salting Password salting means adding a unique random value, the salt, to each password before computing its hash. Two identical passwords then produce different hashes, which makes precomputed tables useless and forces an attacker to crack each account separately. A website should never store passwords in plain text: it only keeps their hash, computed by a one-way function. At login, it recomputes the hash of the password entered and compares the two. Without salt, this process has a major flaw: two people who chose the same password end up with exactly the same hash, and an attacker can prepare tables of hashes for the most common passwords in advance. The salt solves both problems. ## How salting works When a user signs up or changes their password, the site randomly generates a unique string, the salt, and adds it to the password before computing the hash. The salt is stored alongside the hash, in plain text: it doesn't need to be secret. Its job is to make every computation unique. ![Two-column comparison: without salt, Alice and Bob, who use the same password, get the same hash, which a precomputed table cracks in one go; with a different salt for each, the hashes differ and each account must be attacked separately](https://www.wp-masquerade.com/media/2026/10/salage-meme-mot-de-passe-en.webp) *The same password with two different salts gives two unrelated hashes.* - **Precomputed tables become useless**: the attacker would have to recompute them for every salt. - **Identical passwords no longer stand out** in a stolen database. - **Each account must be attacked separately**, which multiplies the work of an offline attack. Salt doesn't make a weak password strong, though: “Sunshine2024” is still among the first guesses of a [brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/). That's why salting is paired with a deliberately slow function such as [bcrypt](https://www.wp-masquerade.com/glossary/bcrypt/), scrypt or Argon2, which build the salt in automatically. ## Salt, pepper and recommendations OWASP distinguishes the salt, unique to each password and stored with it, from the pepper, a shared secret kept outside the database, for example in a secrets vault. The pepper adds defense in depth if only the database leaks. In France, the CNIL (France) recommendation on passwords (decision of July 21, 2022) requires never storing them in plain text and transforming them with a secure, non-reversible cryptographic function that includes a salt or a key. *Video: “Password Hashing, Salts, Peppers | Explained!” (Seytonic)* ## For WordPress In WordPress, the word “salt” refers to two things that shouldn't be confused. ### The password salt Since WordPress 6.8, user passwords are hashed with bcrypt by the PHP function `password_hash()`, which generates a random salt for each password and stores it inside the hash itself. There is nothing to configure: salting is automatic. ### The keys and salts in wp-config.php The `wp-config.php` file contains eight constants: `AUTH_KEY`, `SECURE_AUTH_KEY`, `LOGGED_IN_KEY`, `NONCE_KEY` and their counterparts `AUTH_SALT`, `SECURE_AUTH_SALT`, `LOGGED_IN_SALT`, `NONCE_SALT`. Despite their name, these values are closer to a pepper: they are secret and are used to sign login cookies and [nonces](https://www.wp-masquerade.com/glossary/nonce/). If they leak, someone can try to forge valid cookies. - Generate them with the official `api.wordpress.org/secret-key/1.1/salt/` service or the WP-CLI command `wp config shuffle-salts`. - Change them after an intrusion: all existing cookies become invalid and every user has to log in again. - Don't copy them from one site to another, and never publish them in a code repository. Our article [on wp-config.php security settings](https://www.wp-masquerade.com/wp-config-security-settings/) covers these constants and other useful options. For the other side of the problem, passwords reused from one site to another, see password leaks and how to defend against them: a salt doesn't protect a password the attacker already knows, which is why [credential stuffing](https://www.wp-masquerade.com/glossary/credential-stuffing/) is so attractive to hackers. ## Related terms - [bcrypt hashing](https://www.wp-masquerade.com/glossary/bcrypt/) - [Brute-force attack](https://www.wp-masquerade.com/glossary/brute-force-attack/) - [Credential stuffing](https://www.wp-masquerade.com/glossary/credential-stuffing/) - [Nonce](https://www.wp-masquerade.com/glossary/nonce/) - [Two-factor authentication (2FA)](https://www.wp-masquerade.com/glossary/two-factor-authentication/) ## Sources - [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html) - [NCSC: Password administration for system owners](https://www.ncsc.gov.uk/collection/passwords) - [WordPress source code: wp-config-sample.php (keys and salts)](https://github.com/WordPress/WordPress/blob/master/wp-config-sample.php) - [WP-CLI: wp config shuffle-salts](https://developer.wordpress.org/cli/commands/config/shuffle-salts/)