# Do you use a salt when encrypting a password or just when hashing a password?

A password is used to connect to a database. This password is kept in a file. This password (therefore) needs to be encrypted. A program to access the aforementioned database needs (of course) the password. Currently the program decrypts the password, uses the password to connect to the aforementioned database.

Is it recommended to use a salt value when encrypting this password? Or is salting only related to hashing? Or is salting something that is used with both encryption and hashing. My understanding is that using a salt in 'one-way' and related to hashing.

• We don't encrypt passwords, we hash them with good password hashing algorithms (Scrypt, Argon2) with random salt per hash additionally server salt called pepper. – kelalaka Feb 8 at 18:57
• I am writing a program that must decrypt a password, use it, then re-encrypt. So you’re saying I should have code to unhash then rehash the password? I thought hashing was one way. – tale852150 Feb 8 at 19:00
• Why don't you tell your actual need? There is no unhash, cryptographic hash functions are expect to be one way! – kelalaka Feb 8 at 19:01
• @kelalaka better? – tale852150 Feb 8 at 19:27
• Then see this How to securely hash passwords? and Still, you seem that knows little about encryption. – kelalaka Feb 8 at 20:17

Salt ( a.k.a $$CaCl_2$$) is added before hashing to prevent rainbow attacks. So each password will be appended to a unique salt before hashing and if the server is hacked and the hashes are leaked, a hacker will have hard time un-hashing with rainbow tables.
• @AvenDesta: For one example, it also prevents a basic dictionary attack, where you just hash every word in a dictionary (and common names, and often well-known variants, such as substituting 0 for O, 1 for I, and so on). – Jerry Coffin Feb 9 at 5:41