If you know systems are doing SHA(password), you could generate a database of precomputed passwords up to 10 characters. That's called a rainbow table. It can t

If you know systems are doing SHA(password), you could generate a database of precomputed passwords up to 10 characters. That's called a rainbow table. It can take a year to generate one and take a terabyte to store. The benefits of the table is to make lookup really fast. You could still try to brute force up to 10 characters on the fly or try a dictionary of known passwords. Having a precomputed table is much faster though. Systems have to use a salt per user like HASH(username + password) because user+password won't be found in the table. This effectively break usage of rainbow tables. The salt only needs to be unique per user account, an email is good enough. It's nonsense when you say to generate a table per user. It could take a freaking year to generate a table! That's not feasible. That being said. For something like Linux or Windows accounts, if it were using something like HASH(username + password), it could be worthwhile to make a table because the username is always "root", so that use case should use something else than the username as salt. ^^