> However, this would also mean that logging in using an email/username would also require a full scan No it wouldn’t, and that’s what makes this specific case

> However, this would also mean that logging in using an email/username would also require a full scan No it wouldn’t, and that’s what makes this specific case different. In your scenario, you can lookup the column you need by username or email, which is indexed. You can then retrieve the unique salt and password hash with no lookup penalty. This is not possible in the other case because there is no known column that can serve as the index.