What Is Password Hashing and Salting?

What Is Password Hashing and Salting?

Password hashing and salting are techniques that websites and services use to store passwords securely — so that even if their database is breached, your actual passwords are not directly exposed. When you create a password on a well-built site, it is not (or should not be) stored as the plain text you typed. Instead, it is transformed through hashing (and strengthened with salting) so the original password is protected. Understanding these concepts helps you appreciate why some breaches are far worse than others, and why your password practices matter. This guide explains hashing and salting in plain terms.

What Hashing Is

Hashing transforms passwords into a protected form:

A one-way transformation: A hash function takes input (your password) and produces a fixed-size output (the hash) in a way that is practically impossible to reverse. You cannot get the password back from the hash.

Storing the hash, not the password: A well-built site stores the hash of your password, not the password itself. When you log in, it hashes what you type and compares it to the stored hash — if they match, you are authenticated, without the site storing your actual password.

Why this matters: If the database is breached, attackers get hashes, not plain passwords. With proper hashing, recovering the original passwords from the hashes is difficult.

The contrast: Sites that store passwords in plain text (or weakly) expose actual passwords directly in a breach — far more dangerous.

What Salting Is

Salting strengthens hashing against certain attacks:

The problem salting solves: Without salting, identical passwords produce identical hashes, and attackers can use precomputed tables (like "rainbow tables") of common password hashes to crack them quickly.

Adding a salt: A salt is a unique random value added to each password before hashing. This means even identical passwords produce different hashes (because each has a different salt), and precomputed tables become useless.

The effect: Salting makes cracking hashes much harder and slower, forcing attackers to attack each password individually rather than using shortcuts. Each user's password must be cracked separately.

Modern best practices: Strong, slow hashing algorithms designed for passwords (plus unique salts) make cracking even harder — modern password storage uses these.

Why This Matters in Breaches

Hashing and salting explain why breaches vary in severity:

Properly hashed and salted: If a breached site used strong, salted hashing, recovering passwords is difficult — buying you time and reducing the risk, though strong unique passwords are still safest.

Weakly protected or plain text: If a site stored passwords in plain text or with weak hashing (no salt, or outdated fast algorithms), passwords may be exposed or cracked quickly, putting accounts at immediate risk.

You cannot control it: You generally cannot know how a site stores your password, which is why you should assume the worst and protect yourself accordingly.

What This Means for You

Since you cannot control how sites store passwords, your practices matter:

Use unique passwords: This is the key takeaway. If you use a unique password for every site, then even if one site stores passwords poorly and is breached, only that one account is at risk — your other accounts are safe. A password manager makes this practical.

Don't reuse passwords: Reused passwords mean a single weakly-protected breach can compromise all accounts sharing that password (credential stuffing).

Use strong passwords: Strong, long passwords are harder to crack even if hashes are obtained.

Enable 2FA: 2FA protects your account even if your password is exposed or cracked in a breach.

Change passwords after breaches: If a site is breached, change that password (and anywhere reused), regardless of how it was stored.

Reduce exposure: Sharing less data (e.g., temporary email like Temp90 for less-trusted sites) limits what is exposed in breaches.

Frequently Asked Questions

What is password hashing in simple terms?

Password hashing is a one-way transformation that converts your password into a fixed-size output (a hash) that is practically impossible to reverse. A well-built site stores the hash rather than your actual password — when you log in, it hashes what you type and compares it to the stored hash. This means that if the site's database is breached, attackers get hashes rather than plain passwords, and with proper hashing, recovering the original passwords is difficult. It is what allows sites to verify your password without storing it directly.

What does salting add to password hashing?

Salting adds a unique random value (a salt) to each password before hashing. Without salting, identical passwords produce identical hashes, letting attackers use precomputed tables (rainbow tables) to crack many at once. With unique salts, even identical passwords produce different hashes, precomputed tables become useless, and attackers must crack each password individually — much harder and slower. Combined with strong, slow password-hashing algorithms, salting significantly strengthens stored passwords against cracking if a database is breached.

Why does hashing and salting matter for me if I cannot control it?

Because it explains why some breaches are far worse than others, and why your own practices matter so much. You generally cannot know how a site stores your password, so you should assume the worst and protect yourself: use a unique password for every site (so one weakly-protected breach only risks that account), avoid reusing passwords (which enables credential stuffing), use strong passwords (harder to crack), and enable 2FA (protecting accounts even if a password is exposed). Your practices are what you control, and they limit the damage regardless of how a site stores passwords.

Conclusion

Password hashing and salting are techniques that websites use to store passwords securely, so that even if their database is breached, your actual passwords are not directly exposed. Hashing is a one-way transformation that converts your password into a hash that cannot practically be reversed, so a well-built site stores the hash rather than your password and verifies logins by comparing hashes. Salting adds a unique random value to each password before hashing, so identical passwords produce different hashes, defeating precomputed cracking tables and forcing attackers to crack each password individually. Together, with strong password-hashing algorithms, they make recovering passwords from a breach much harder — which is why properly protected breaches are far less dangerous than plain-text or weakly-hashed ones. Since you cannot control how sites store your password, your own practices are what matter: use a unique password for every site (so one poorly-protected breach risks only that account), avoid reuse, use strong passwords, enable 2FA, and reduce your exposure (using temporary email like Temp90 for less-trusted sites). By understanding hashing and salting, you can see why these password practices are so important and how they protect you regardless of how any individual site stores your credentials.