Password salting and peppering
A unique public salt makes every password hash different; a separate secret pepper makes a stolen hash database harder to crack by itself.
See it
What it is
A salt is a random value generated separately for every password and stored with its hash. It makes identical passwords produce different records and defeats precomputed rainbow tables. A pepper is different: it is one secret held outside the password database, usually in a secret manager, so a database dump alone is not enough to test guesses. Argon2id and bcrypt libraries create and encode salts for you.
Always salt password hashes; add a pepper when the extra operational complexity buys useful defense in depth. One sound pattern is to HMAC-SHA-256 the password with the pepper, then feed that result to Argon2id with a fresh library-generated salt. Store the complete Argon2id encoded string, but keep the pepper in AWS Secrets Manager or another access-controlled secret store.
Neither value is magic. A salt is public and does not rescue a weak or fast hash such as SHA-256. LinkedIn's 2012 dump is the standing lesson: 6.5 million unsalted SHA-1 hashes, most of them cracked within days. A pepper must not sit in the same database, repo, or environment dump as the hashes. If the pepper is lost, logins cannot be verified; if it leaks, rotating it usually requires keeping the old pepper during login migration or forcing password resets.
Ask AI for it
Implement password storage with Argon2id plus a pepper. Read a 256-bit pepper from AWS Secrets Manager, compute HMAC-SHA-256 over the UTF-8 password with that pepper, and pass the binary result to Argon2id with a fresh random salt generated by the maintained Argon2 library. Store the library's full encoded Argon2id string, including algorithm, parameters, salt, and hash. Verify with the same HMAC step and the library's constant-time verify function. Never log passwords, HMAC outputs, peppers, or hashes. Add a pepper version for rotation, support the current and previous versions during login migration, rehash on successful login, and test duplicate passwords, wrong passwords, and missing pepper configuration.