4 ms·

Thanks. I'm no security expert but I couldn't see how it would make a difference.

• drivebyacct2 14y ago
  Sure, to help illustrate it further: (don't use SHA1, I'm using it to avoid a discussion of why you wouldn't manually use a salt with bcrypt) user1: SHA1("salt123"+"puppydog11") = SOME_HASH user2: SHA1("salt456"+"puppydog11") = SOME_DIFF_HASH This way, even for the same password, there are different salts, and thus different hashes. No one can run a rainbow attack unless they've generated rainbow tables for that salt (frankly, it would be possible, but useless to generate a rainbow table for a specific salt)