Salt in Crypto

In cryptography, a salt is a random string of data added to an input before it is hashed. Two users with the same password end up with completely different hash values because each has a unique salt mixed in. This breaks the most common password-cracking method: comparing stolen hashes against a precomputed list of known values.

Why Salting Matters for Security

A hash function converts any input into a fixed-length output. SHA-256 turns "password123" into the same 64-character string every single time. That consistency is useful for verification but deadly for security if the hash database leaks.

Without salting, an attacker who steals a database of hashed passwords can compare each hash against a precomputed "rainbow table," a massive lookup list mapping common inputs to their hash values. Finding a match takes seconds. Salt destroys this attack. Even if two users have the same password, their salted hashes look nothing alike, and no precomputed table covers every possible salt-and-password combination.

How Salt Works in Blockchain Applications

Smart contracts and decentralized applications use salt in several specific contexts.

• Commit-reveal schemes. When you want to submit a bid or vote without revealing it early, you hash your choice together with a secret salt and submit the hash. Later you reveal the original choice plus the salt. Anyone can verify that the hash matches, confirming you did not change your answer after seeing others' responses.
• CREATE2 address derivation. Ethereum's CREATE2 opcode lets developers deploy a smart contract to a predetermined address by including a salt value in the derivation formula. The salt allows the same deployer to generate different addresses for different contracts using the same base logic.
• Password-protected wallets and vaults. Applications that use password-based encryption for private key storage salt the password before deriving the encryption key. This prevents precomputed attacks against encrypted wallet files.

Salt vs. Pepper: A Related Security Concept

Salt is stored alongside the hash, usually in the same database. A pepper is a secret value added to the hash that is stored separately from the database, typically in application code or a hardware security module. If an attacker steals your database, they get the salts but not the pepper. The combination of both provides a stronger defense than either alone.

In crypto wallet applications, the distinction matters when evaluating how a wallet provider stores credentials. A provider using both techniques gives you a meaningfully more secure credential system than one that only salts, especially if their database has ever been exposed.

Sources

https://eips.ethereum.org/EIPS/eip-1014
https://csrc.nist.gov/publications/detail/sp/800-132/final
https://owasp.org/www-community/attacks/rainbow_table_attack