I have recently started to get into web development and thus I have been creating databases for users.
After some research, I discovered that password encryption is not password hashing.
My next spell of learning was that I needed to add salts to my passwords to make them harder to crack.
For this I implemented a hard-coded salt to the start of all my passwords; I later learned that actually the salts should all be different, otherwise they are just peppers.
I created a table in my database that stores the passwords and the salts (maybe a question for a different day, but I am not sure where to store the salts).
The passwords are hashed using MD5 and then stored. (There is not really a reason as to why I chose MD5 and if it is better to use another one then I will.)
I currently use a PRNG to create the salt upon registration to the site. The salts are not hashed and are simply just stored in a separate field to the password.
What is a good salt?
Assuming someone gains access to the databases. They would see a series of MD5 hashes and then a series of random numbers and letters (8 bytes currently).
I understand that the question may appear open-ended.
Would I need to hash my salts (that sounds weird to me), create longer salts, or do something else?