Going to take it from the top. Skip down for the actual pepper information if you're already familiar with hashing and salting (I assume most people will be).

Going to take it from the top. Skip down for the actual pepper information if you're already familiar with hashing and salting (I assume most people will be). Let's assume you want to store a password. The first, obvious step, is to store it in plain text. This is obviously brain dead, but well, we live in the world we live in. $user_pw = $password; The second step is to hash it. This means that the password can't just be read out of the database. $user_pw = hash($password); The problem with this approach is that with the amount of computing available, it's fairly trivial to just bruteforce everything, and with the advent of rainbow tables (pre-cracked hashes), it gets even easier. The next obvious step is to salt the password. Salting means that you add a random piece of information to what you hash, in order to disable the use of rainbow tables. Every password has to be cracked individually. The salt needs to be included in the stored form of the hash, because otherwise you can't calculate incoming authentication requests against it. $user_pw = concat($salt, ':', hash(concat($salt, password))); This makes a targeted attack possible, but mass attack over a long list of passwords gets quite a bit more difficult. The problem is that now, you have the salt always stored with the password. This means that if your database gets stolen/dumped, an attacker has all the information required to crack specific hashes. In order to alleviate this, you can use a pepper, which is similar to a salt, except that it is global and unique to your application, and doesn't change all the time. It is a static piece of data that gets hashed as well, but isn't stored alongside the hashes in the database. $user_pw = concat($salt, ':', hash(concat($salt, $PEPPER, password))); This obviously only changes anything if your pepper doesn't get stolen alongside the database, so this is usually an application-specific constant that doesn't get stored in the database.