4 ms·

> at least these guys (apparently) salt, etc It seems the salt was stored in the database itself. https://twitter.com/sajal_thomas/status/865134165288599553 h

• Confiks 9y ago
  I don't see anything in that Twitter thread indicating where the salt was stored, but salts are actually supposed to be stored next to the password hash. They purely try to prevent precomputation of password hashes by introducing a random value per password, and that works just fine by putting them next to the hash. Today, of course you shouldn't be manually maintaining salts and instead use a proper PBKDF (which indeed uses a salt, which is stored alongside the hash).