Last pass used both: a global salt and a per-password salt. The idea was that the global salt isn't stored in the database so if the attacker doesn't have acces

Last pass used both: a global salt and a per-password salt. The idea was that the global salt isn't stored in the database so if the attacker doesn't have access to the application server, they cant find what that salt is at all.