Someone steals a database of password hashes. Instead of cracking each one individually, they check it against a rainbow table — a massive precomputed list mapping hashes to the passwords that produced them. If a stolen hash shows up in that table, they're done in milliseconds. No cracking required, just a lookup.
Salting kills this attack entirely, and it's a small enough fix that it's worth understanding exactly why it works rather than just knowing "you're supposed to do it."
This is part 2 of a series where I'm documenting what I'm learning building CryptoGraphy, a small Python project I'm using to actually understand applied cryptography instead of just calling library functions.
What a salt actually does
In main.py, before any key derivation happens, a fresh random salt is generated:
