Salting would definitely make a difference. The point of salting is to increase the complexity and overhead of generating rainbow tables. The first mistake her

Salting would definitely make a difference. The point of salting is to increase the complexity and overhead of generating rainbow tables. The first mistake here is the use of MD5. MD5 is flat out broken. Do Not use md5. Do use bcrypt. In your db, you can store the salt right there....next to the hash... How a salt increases the complexity is quite simple. If a attack has a giant rainbow table, the salt causes him to increase the size of his rainbow table and the space required to hold it and the pre-processing time to generate it. For example Here is what your database might look like with a 3 byte salt password : salt hunter2 : 100 qwerty1 : 101 Here is what the attacks rainbow tables will have to look like qwerty1 : 101 hunter2 : 100 qwerty1 : 100 hunter2 : 101 hunter2 : 103 qwerty1 : 102 ... .. . That's about it. There are other purposes of the salt too but other people talked about those ones.