The way 'salt' secures a digital password

Hackers are lazy. They keep massive "cheat sheets" of common passwords already scrambled into code, so they can match yours in seconds. It’s all very efficient and quite annoying.

To ruin the fun, we use "salt." Before your password is encrypted, the computer sprinkles in a bit of random nonsense. It’s like adding a unique, secret spice to every single dish in the kitchen.

Even if two people use the same password, the salt ensures their final codes look nothing alike. It turns a quick search into a dreadful slog.

Wait, if the salt is random, how does the computer remember it?

It simply writes it down right next to your username in the database. Think of it like a little label stuck onto a jam jar in the pantry. It's not a secret; it's just a record of what was added.

The computer needs that label to recreate the exact same scrambled mess when you log in. Without it, the machine would be as forgetful as your grandfather looking for his spectacles.

It's a bit of faff, but the salt doesn't need to be hidden. Its only job is to ensure your jar looks unique, even if the recipe is common.

But isn't that just giving the hacker a head start?

Not at all, dear. Remember those 'cheat sheets'? Hackers build them once to unlock millions of doors. They want one master key that fits every house in the street.

By adding a unique salt, you’ve changed the lock. Even if the hacker sees your 'recipe' on the label, they must go back to the kitchen and cook a brand-new cheat sheet just for you.

It turns a five-minute break-in into a lifelong project. They might know the ingredients, but they haven't the time to bake a billion different cakes.

Can't they just buy a bigger oven to bake those cakes faster?

They certainly try, dear. They use specialized chips that can guess millions of passwords a second. It's like hiring a thousand sous-chefs to work in a giant industrial kitchen.

To stop them, we make the recipe intentionally exhausting. We tell the computer to scramble the salted password not once, but thousands of times over.

It’s like kneading dough for ten hours instead of ten minutes. Even with the fanciest oven in the world, you can’t bypass the physical labor of the prep work. It makes the 'faff' too expensive for them to bother.

Doesn't that mean I'll be stuck waiting forever just to check my email?

It’s a tiny delay for you, dear—hardly longer than waiting for a kettle to whistle. You might wait half a second, which is just enough time to reach for a biscuit.

But for the hacker, that half-second is a total disaster. If they have to repeat that wait for every one of their billion guesses, they’d be sitting there for centuries.

We’re essentially trading a speck of your patience to ensure a thief would need several lifetimes to break in. It’s a very sensible trade-off.