Question

I understand that if we just hash a password, a hacker could use a pre calculated hashed password table and compare it to the actual hashed password table. From what I understand if we add a random string as a salt before hashing, the pre calculated hash table won’t work.

Now my question is, suppose a users password is “password”, I add 999 to it and hash the string “password999” before saving it. Now when the user returns to my site, how do I know that I need to add 999 to his password before it is compared to the hashed values in the database? Do I maintain a separate table with all the salts for every username?

Answer 1

You need to store the salt for each user in a separate column next to the password.