Do I need this if I'm using bcrypt or Argon2?

Usually not. Modern password-hashing functions like bcrypt and Argon2 generate and embed their own random salt automatically as part of hashing — you don't call this tool for that. It's more useful for implementing a hashing scheme yourself, or for teaching what a salt is and why it matters.

Does a salt need to be secret, like a password?

No — a salt is stored right alongside the password hash, in plain text, and that's fine. Its job is to make every password's hash unique, so an attacker with a precomputed table of common password hashes gets no benefit; it is not a second secret protecting the hash.

Salt Generator

Generates a cryptographically random, hex-encoded salt — the kind of value used alongside a password hash to defend against precomputed-hash attacks. A sample generated locally, not tied to any real stored credential.

Your result will appear here.

How to use this tool

Press generate for a salt value.
Copy it, or generate again for a new one.

Worked examples

A generated example: c1a530356de1beb32d5dbd569ce9f7d5 — 16 random bytes (128 bits) as 32 lowercase hex characters.

Common use cases

Password-hashing implementation examples
Security teaching examples
Documentation examples

How this generator works

16 bytes are drawn from your browser's Web Crypto random generator and written out as 32 lowercase hex characters, the same mechanism as the nonce generator on this site. Most modern password-hashing functions such as bcrypt and Argon2 generate and manage their own salt internally, so this tool is aimed at implementations or teaching examples that need to demonstrate or supply one explicitly.

Randomness and fairness

All 16 bytes come from your browser's cryptographic random generator. There is no seeded mode, since a reproducible salt would defeat its purpose.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

Salts are stored alongside the hash and are not secrets. What matters is that every password gets its own; reusing one salt across a database defeats the purpose.
Fixed at 16 bytes (128 bits) with no length control on this page. Most modern password hashing libraries (bcrypt, Argon2, scrypt) generate their own salt internally and do not need one supplied externally at all.

Privacy and your data

Salts are generated in your browser and never sent anywhere. Nothing is stored, so the value you copy is the only copy.

A locally-generated sample value — not tied to any real stored credential.

Frequently asked questions

Do I need this if I'm using bcrypt or Argon2?: Usually not. Modern password-hashing functions like bcrypt and Argon2 generate and embed their own random salt automatically as part of hashing — you don't call this tool for that. It's more useful for implementing a hashing scheme yourself, or for teaching what a salt is and why it matters.
Does a salt need to be secret, like a password?: No — a salt is stored right alongside the password hash, in plain text, and that's fine. Its job is to make every password's hash unique, so an attacker with a precomputed table of common password hashes gets no benefit; it is not a second secret protecting the hash.