Pepper (cryptography)

The article's lead section may need to be rewritten. Please help improve the lead and read the lead layout guide. (July 2024) (Learn how and when to remove this message)

In cryptography, a pepper is a secret added to an input such as a password during hashing with a cryptographic hash function. This value differs from a salt in that it is not stored alongside a password hash, but rather the pepper is kept separate in some other medium, such as a Hardware Security Module.^[1] Note that the National Institute of Standards and Technology refers to this value as a secret key rather than a pepper. A pepper is similar in concept to a salt or an encryption key. It is like a salt in that it is a randomized value that is added to a password hash, and it is similar to an encryption key in that it should be kept secret.

A pepper performs a comparable role to a salt or an encryption key, but while a salt is not secret (merely unique) and can be stored alongside the hashed output, a pepper is secret and must not be stored with the output. The hash and salt are usually stored in a database, but a pepper must be stored separately to prevent it from being obtained by the attacker in case of a database breach.^[2] Where the salt only has to be long enough to be unique per user^{[dubious – discuss]}, a pepper should be long enough to remain secret from brute force attempts to discover it (NIST recommends at least 112 bits).