← Entropy Atlas
Fresh or unique
Password salts
A salt separates equal passwords and defeats one precomputed table from serving every account.
Evaluation card
What “plenty” means here.
- Required property
- A distinct value per password record; it is stored openly beside the verifier.
- If it fails
- Reused or tiny salts reveal equal passwords and make precomputation reusable.
- Relevant attacker
- An offline attacker who steals many password hashes.
- The Plenty Line
- Use the password-hashing library’s recommended salt size and generator; uniqueness at system scale is the target.
- Why more is not automatically better
- Salts need not be secret, and extra salt entropy cannot compensate for a fast or under-costed password hash.
Where it appears
Recognize the pattern.
- 01Argon2 salts
- 02scrypt salts
- 03PBKDF2 salts
The Plentropy rule
Protect the requirement, then stop.
Use the password-hashing library’s recommended salt size and generator; uniqueness at system scale is the target.
Once that claim has comfortable evidence and margin, improve the next limiting factor instead of worshipping a larger entropy number.