This lesson's interactive features are locked, please to keep using them
Salts
Two people should be allowed to choose the same password, but they should not end up with the same stored hash.
Without a salt, identical passwords produce identical hashes. A database leak would reveal which accounts share a password and let an attacker reuse the same precomputed guesses against every matching row.
Encoded Salts
A salt is random data mixed into one password-hashing operation. It doesn't need to be secret, but it must be unique and unpredictable.
Go's low-level Argon2 package doesn't generate or encode salts for the application. Bearly Secure generates a fresh salt with crypto/rand and stores it inside the encoded Argon2id string:
$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>
That string contains everything verification needs:
- The Argon2 variant and version
- The cost parameters
- The salt
- The derived password hash
Don't keep one shared salt, treat salts as secrets, or concatenate an ad hoc value into the password. Generate a fresh salt for every hash and keep it with that hash in one well-defined format.