You're right - dictionary attacks aren't more vulnerable using a password hash. As a rule, a hash will obviously only add complexity. Salting the hash in additi

You're right - dictionary attacks aren't more vulnerable using a password hash. As a rule, a hash will obviously only add complexity. Salting the hash in addition to that will prevent a list of common words, and corresponding hashes ("dictionary attack") from working because of the nonsense salt value. However, the real value of salting a hashed password is in defeating multiple password cracks. The salt is like a nonce added to a each individual password so that if you crack one, you can't formulaically crack them all. While en masse this is tedious, applied to a single password it's meaningless because the processing time for brute-forcing a salted hash and a non-salted hash will be trivial. It's mainly useful because you can't "recycle" computational power applied to one cracked password for another, assuming you have e.g. a database in front of you. To give a quick explanation of why a salt won't protect a single password, consider it this way - salting passwords allows each hash to come out differently, such that if you try to crack a list of passwords using a single algorithm it won't work because the salt randomizes each one. Repeating the computational steps for cracking one password will be null and void for finding additional passwords if they're salted - you'll have to start over.