This lesson's interactive features are locked, please to keep using them

Salts

Two people should be allowed to choose the same password, but they should not end up with the same stored hash.

Without a salt, identical passwords produce identical hashes. A database leak would show which accounts share a password and let an attacker reuse the same precomputed guesses against every matching row.

Library-Managed Salts

A salt is random data mixed into one password-hashing operation. It doesn't need to be secret, but it should be unique and unpredictable. Luckily, the argon2 library generates a random salt and stores it inside the encoded hash:

$argon2id$v=19$m=19456,t=2,p=1$<salt>$<hash>

That single string contains everything verification needs:

The Argon2 variant and version
The cost parameters
The salt
The derived password hash

Don't add a salt database column or concatenate one into the password yourself! Good KDF libraries own the format, salt generation, and verification rules and store everything in a single encoded string.