Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In order to make passwords more secure , a random salt is added to the password before harshing occurs .

I am assuming the salt is stored on the server in an associative array [username:salt] and the server appends the salt to the password before harshing everytime the user logins else the server wouldnt know what random salt to append to the password

1) Is my assumption correct ???

2) Is the salt normally stored in plain text or cipher on the server and why ??

3) Which file is it stored in ?? ( i know this may be subjective as it depends on the different servers)

I would like a detailed explaination if possible


share|improve this question

It's concatenated with the encrypted password string (possibly with delimiter characters, possibly just a fixed number of characters; depends on which particular password file you're talking about) So, for example, my /etc/shadow contains $6$prRzIBxG$K4w0950HW9eMmVgzqpmdgfpxqmFtXZx.mS7wGorSoeXvt51tejXxx22CoTsrmj9AsszgT.CvkB5BrPuMq1r.Z/ as the encrypted password. The $6$ is a control sequence, and the salt is pr.

(Note, that's on password-file systems like UNIX; you also tagged IIS, but Windows stores passwords, salts, etc. in a rather opaque datastructure called a SAM.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.