Password Hashing Salt Explained – Java Security Interview

Direct Answer

A salt is a unique, randomly generated value used with one password before the password-hashing function runs. It makes equal passwords produce different stored verifiers and prevents one precomputed table from working across many accounts. The salt is stored with the hash and does not need to be secret. It does not stop offline guessing by itself; the password function's memory/time cost provides that resistance.

Code Example

PasswordEncoder encoder = new Argon2PasswordEncoder(
    16,       // salt bytes
    32,       // hash bytes
    1,        // parallelism
    19 * 1024,// memory in KiB
    2);       // iterations

String first = encoder.encode("same-password");
String second = encoder.encode("same-password");

System.out.println(first.equals(second));       // false: fresh salts
System.out.println(encoder.matches("same-password", first));  // true
System.out.println(encoder.matches("same-password", second)); // true

The encoder generates and stores the salt in each encoded value. Application code should not split, concatenate, or regenerate it during verification.

Common Mistakes & Pitfalls

• Treating the salt as secret: Freshers often think salts should be stored in environment variables or config files separate from the database. This is wrong—salts are stored right next to hashes, often in the same string. The security comes from randomness and uniqueness, not secrecy. An attacker with database access gets the salts, and that's fine because rainbow tables still don't work.
• Using the same salt for all users: A single global salt defeats the entire purpose. If every user shares salt "myappsalt2024", an attacker builds one rainbow table with that salt baked in and cracks all passwords. Each user must have a unique, randomly generated salt.
• Using non-cryptographic random: Doing new Random().nextBytes(salt) or Math.random() produces predictable salts that an attacker can guess. Always use SecureRandom, which is designed for cryptographic purposes.
• Re-salting on every login attempt: Some freshers think you generate a new salt each time you verify a password, but that would make verification impossible—you need the original salt that was used during registration.