thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Fundamentals & Crypto

Salt vs Pepper in Password Hashing: What's the Difference?

A salt is a unique random value stored alongside each password hash so identical passwords produce different hashes and rainbow tables fail. A pepper is a secret value shared across all passwords and stored separately from the database, so a stolen database alone is not enough to crack hashes.

SaltPepper
UniquenessUnique per passwordSame for all passwords (or per application)
SecrecyNot secret, stored with the hashSecret, kept outside the database
Storage locationDatabase row next to the hashApplication config, HSM, or secrets vault
DefeatsRainbow tables and identical-hash detectionOffline cracking after a database-only breach
Required by standards?Yes, effectively universalOptional defense in depth
Remember it

Salt is public and unique; pepper is secret and shared.

Exam tip

Rainbow table questions almost always want salting as the answer. If the question adds key stretching, think bcrypt, PBKDF2, or Argon2, which apply many iterations to slow brute force.

Tested on

More Security Fundamentals & Crypto look-alikes