Software Securityhome
Fix a findingSearch
Glossary

Pepper

A secret value combined with each password before or during hashing and stored apart from the password database, for example in an HSM or a secrets manager, so a stolen database alone does not allow offline guessing. Unlike a salt it is shared across records and must stay secret, and losing it makes every hash that uses it unverifiable.

Covered in

Guide

Password storage: hashing parameters and rehash on login

Choose Argon2id, scrypt, PBKDF2 or bcrypt with current minimum parameters, store a versioned hash, and upgrade old hashes after a successful login without overwriting a reset.

Practice: Password hashing lab: Verify and upgrade an Argon2 password hash on login

Find your next answer

Type to search. Search runs in your browser.

Searches run in your browser, but the host can infer them from the index files they load. The address shows your search so you can bookmark or share it.