In my database, I have a column for the hashed password and the salt. My application allows users to change their password. Should I use the same salt for the password, or should I generate a new one? Does it matter to the security of the application?


1 Answer 1


Yes. Always generate a new salt when the password is changed.

Consider the following two scenarios:

Known not changing salt

I know you aren't changing the salt for your passwords. I see admin has a salt that is 'xyz', and now I grind out the rainbow table for that salt. Doesn't matter what you change your admin password to, I know it.

Repeated passwords

I know that the user had a hashed password of 'xyz:abcdef' (xyz is the salt, abcdef is the hashed password). Then later I see that the hashed information is 'xyz:012345' - ok, they changed their password. Yet later I see the hashed password as 'xyz:abcdef' and I know they've changed it back the first password.

These two scenarios where unnecessary information is given to the attacker is trivially avoided by generating new salt each time a password is generated.

You'll note that italics on the "when the password is changed" above. This was added after a comment by darkhogg asking if changing the salt more often is "better, worse, or just useless?"

On Security.SE the question of How often should I reset my salt? answers this. Changing the salt more frequently than the password changes gives a possible attacker more information about the password than just one hash.

Changing the salt more often than the password doesn't mean that an attacker will be more hindered by the new information because the same correct password will still work no matter what the salt is.

  • This might be enough for another question, but... Would changing the salt from time to time (say, 10-30 days) after a successful login be better, worse, or just useless?
    – Darkhogg
    Mar 30, 2014 at 19:50
  • @Darkhogg that is indeed an interesting question and would probably be something to head over to Security.SE to ask.
    – user40980
    Mar 30, 2014 at 20:26
  • 3
    I think I just found my answer, I'll link it for completeness security.stackexchange.com/questions/39821/…
    – Darkhogg
    Mar 30, 2014 at 20:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.