A salt is random data mixed into password hashing or key derivation so identical passwords do not produce identical derived keys across users or vaults. Salts are not secret like passwords; they must be unique and stored with the verifier or vault header.
Why salts matter
Without salts, attackers precompute rainbow tables for common passwords. With unique salts, each guess must be recomputed per vault. Combine salts with a strong KDF such as Argon2id.
Related
KDF � Argon2id � Zero-knowledge
Salt vs pepper vs nonce
A pepper is a secret server-side value sometimes mixed into hashes; AzAd Vault’s local model focuses on per-vault salts rather than a vendor pepper for decrypting your items. A nonce or IV is used during AES-GCM encryption of payloads and must be unique per encryption under a key. Different jobs, similar “random bytes” intuition.
Never “turn off salt” — implementations should generate and store salts automatically. Your job is choosing a strong master password and keeping backups.
User actions
You generally never type a salt. Apps generate them. Your actions: strong master password, unique site passwords, encrypted backups, and skepticism toward DIY “encryption” spreadsheets that skip salts and authenticated modes entirely.
Learn adjacent terms: KDF, Argon2id, AES-256-GCM.
Practical takeaway
Trust the app to salt correctly. Focus energy on unique site passwords and MFA upgrades. Salts are necessary plumbing — master password entropy is still the faucet you control.
Related reading on azadvault.com includes the security page, blog guides, and companion glossary entries for Argon2id, AES-256-GCM, and zero-knowledge. AzAd Solutions ships AzAd Vault for Android, Windows, and Chrome with a concrete Free tier (500 items, 20 labels, 10 TOTP) and Play-billed Premium.