> "Salts" have been password-specific since Ken Thompson invented them in the '70s. Thanks, that's where my misunderstanding was. I've seen "salt" used (appare

> "Salts" have been password-specific since Ken Thompson invented them in the '70s. Thanks, that's where my misunderstanding was. I've seen "salt" used (apparently, improperly) in cases where the hash is the same for all passwords. Even the wikipedia article seems to imply that use case. The other part of my misunderstanding was that I was thinking of BCrypt as a deterministic function. Looking at an implementation, it looks like multiple calls to BCrypt::Password.create with the same value can result in different values, unlike how sha1($x) = sha1($x) for any $x.