Wow you’re aggressive. Using something like Hashi Vault, Gluu, or Shiro does not overly complicate things. They’re stable, trusted solutions. It can also grea

Wow you’re aggressive. Using something like Hashi Vault, Gluu, or Shiro does not overly complicate things. They’re stable, trusted solutions. It can also greatly simplify things. In the common scenario of having a web app for customers and a web app for admins, instead of them each having their own authentication baked in, you can choose an open source solution and deploy it twice, once for each service. I know how salt works. Don't belittle me. If someone gets into your web servers they’ve pretty much got carte blanche at your database the web server has access to. They also now have your code, which in a lot of cases is probably plainly readable. So they can see your salt, see how you salt and see the hashing algorithm you've chosen. I’m saying don’t store the salt in your apps config right along with the credentials to access all of your login identifiers and hashed passwords. You gave them a piece of the puzzle. If someone wants to grind through and crack all the salted/hashed passwords, I'd prefer them not to have the salt to help in that endeavor.