thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Intermediate

Pepper

A secret value added to passwords before hashing and stored separately from the password database.

Definition

Unlike a salt, a pepper is secret and usually shared across all passwords, kept in an HSM, vault, or application configuration. If the database is stolen without the pepper, offline cracking is far harder. It complements, not replaces, per-user salts.

Example

An application HMACs each password with a pepper stored in Azure Key Vault before applying Argon2id.

Exam tip

Salt is stored with the hash; pepper is stored separately and kept secret.

Don't confuse it with

Related terms