Salt Length Requirement Calculator

Work out salt length requirement instantly with clear inputs, formula shown and shareable results.

About Salt Length Requirement Calculator

A salt does not need to be secret, only unique. Its job is to ensure that identical passwords hash differently, which defeats precomputed tables and stops an attacker cracking one hash and matching it across accounts. NIST SP 800-132 recommends at least 128 bits, and the birthday bound shows why: at 64 bits, ten million users already have a non-trivial chance of a repeat.

Formula

Salt uniqueness

salt bits = bytes x 8; distinct values = 2^bits; P(duplicate) ~ 1 - exp(-users^2 / (2 x 2^bits))

Worked example

With the default values below, Salt Length Requirement Calculator returns Salt entropy of 128. Change any input above and every figure here is recalculated in your browser.

Inputs used

Salt lengthaccepts 1–64 bytes: 16 bytes
Passwords storedminimum 1: 10,000,000

Results

Salt entropy: 128 bits
Distinct salt values available: 10^38.53
Probability any two users share a salt: 1.469e-25
Assessment against guidance: Meets modern guidance (128 bits or more)

Step by step

1Values used
2Salt uniqueness
3Salt entropy= 128 bits
4Distinct salt values available= 10^38.53
5Probability any two users share a salt= 1.469e-25
6Assessment against guidance= Meets modern guidance (128 bits or more)

Assumptions and limits

The result is derived only from the 2 inputs listed above. Anything not among them is not part of the calculation.
In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

Does the salt need to be kept secret?

No. It is stored alongside the hash. A secret value added separately is called a pepper and is an additional defence, not a replacement for the salt.

Can I derive the salt from the username?

No. Usernames repeat across sites and are predictable, so an attacker can precompute tables for common accounts. Use a cryptographically random salt per credential.