← Years 9–10 Digital Systems

Salting a password hash

A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 25, VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 77, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 104, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 150, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 41, WA Computer Science ATAR Year 11 — Cyber Security — Module 89

Understanding Salting a password hash in Years 9–10 Digital Systems

What it does: Different salts for each user mean the same password hashes to a different result for each account. Adding a salt changes the hash, so a table of unsalted hashes no longer contains the matching value. A salt is random data mixed in with the password before hashing. It does not make the hash reversible. The salt is joined to the password first, then the combined text is hashed, so the result is unique to that salt. The fix is to generate a new random salt for each user, for example salt = random_string(16).

Common mistakes: A salt must be random. A fixed, guessable text like "abc123" can be built into an attacker's precomputed table. It should be salt ← random_bytes(16). The salt must be saved with the hash. Without it the system can't repeat the hashing when the user logs in. It should be save(user, salt, hash).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Salting a password hash to a class →

This module's key terms are also in a printable crossword (Modules 25–40) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What is a salt in password storage?
A random value added to a password before it is hashedA secret key that lets you turn a hash back into the password
Matches
salt = "abc" hash(password + salt)
↓
The salt is a fixed value, not random, so every user shares the same salt and identical passwords still give identical hashes.
Applying
Meanings
Term
salt
Meaning
A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.
Practice
salt ← random_value()
Testing
Gaps
storedHash ← hash( + password)
Check Answer
Spots
1password ← "hunter2"
2salt ← "abc123"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Cosmic Owl' badge — Comprehension Guru, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What is a salt in password storage?
A. A random value added to a password before it is hashed ✓
B. A secret key that lets you turn a hash back into the password
A salt is random data mixed in with the password before hashing. It does not make the hash reversible.
2. Two users both choose the password 'sunny123'. Their accounts use salting. What will their stored hashes look like?
A. Identical, because the passwords are the same
B. Different, because each user has a different salt ✓
With a different salt for each user, the same password produces different hashes.
3. Which system gives each user their own salt?
A. Each account gets a new random salt when the password is set ✓
B. One salt is shared by every user in the database
A unique salt per user means cracking one hash does not help the attacker crack the others.
4. An attacker has a precomputed table of hashes for common passwords. How does salting affect it?
A. The table still works, because salting only hides the username
B. The table no longer matches, because the salt changes every hash ✓
Precomputed hash tables only work for unsalted passwords. A random salt means the attacker would need a new table for every salt.
5. Which hash is better protected: hash('password') or hash('password' + 'k8Zq2x')?
A. hash('password' + 'k8Zq2x'), because a salt is added ✓
B. hash('password'), because it is shorter and simpler
Adding a random salt before hashing stops the hash matching a known table entry for 'password'.

Match the Pairs

hash(password + salt) → Adds a random salt to the password before hashing it
salt = random_string(16) → Creates a new random salt for a user
Each user gets their own salt, so two users with the same password end up with different hashes → user1.salt != user2.salt
A salt defeats precomputed hash tables because the attacker cannot prepare hashes for every possible salt → hash("cat123" + "x9Qp") != hash("cat123")
salt = "abc" hash(password + salt) → The salt is a fixed value, not random, so every user shares the same salt and identical passwords still give identical hashes.
store(username, password, salt) → The plain password is stored instead of the salted hash, so anyone who steals the database can read it.

Key Term

salt
A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

Fill in the Blanks

1. storedHash ← hash(salt + password)
Hint: Type the variable holding the random value that is added to the password before hashing.
2. salt ← random(16) storedSalt ← salt
Hint: Type the function name that creates an unpredictable value for the salt.
3. hash1 ← hash("cat123" + salt1) hash2 ← hash("cat123" + salt2)
Hint: Type the variable holding the second user's own salt, which makes the same password hash differently.
4. IF hash(attempt + salt) == storedHash PRINT "Login OK"
Hint: Type the comparison operator that checks whether the salted hash matches the stored one.
5. FOR EACH user IN users user.salt ← random(16) user.hash ← hash(user.pw + user.salt)
Hint: Type the loop keywords that give every user their own salt.

Spot the Error

Question 1
A password ← "hunter2"
B salt ← "abc123"
C hash ← sha256(salt + password)
D store(user, salt, hash)
Line B — A salt must be random. A fixed, guessable text like "abc123" can be built into an attacker's precomputed table. It should be salt ← random_bytes(16).
Question 2
A salt ← random_bytes(16)
B combined ← salt + password
C hash ← sha256(combined)
D save(user, hash)
Line D — The salt must be saved with the hash. Without it the system can't repeat the hashing when the user logs in. It should be save(user, salt, hash).
Question 3
A row ← lookup(user)
B salt ← row.salt
C hash ← sha256(attempt)
D if hash = row.hash then
Line C — At login the stored salt must be added to the attempt before hashing. Leaving it out gives a different hash, so the right password would fail. It should be sha256(salt + attempt).
Question 4
A salt ← get_shared_salt()
B hash ← sha256(salt + password)
C store(user, salt, hash)
Line A — Each user needs their own new random salt. One shared salt means identical passwords give identical hashes again. It should be salt ← random_bytes(16).
Question 5
A salt ← random_bytes(16)
B salted ← password
C hash ← sha256(salted)
D store(user, salt, hash)
Line B — The salt has to be joined to the password before hashing. Here the salt is ignored, so the hash is unsalted. It should be salted ← salt + password.

Student with a class code? Join your class →