SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-salt-min-length

NIST's digital identity guidelines say a password salt must be at least how long?

32 bits, chosen to avoid duplicate salts among stored hashes.

Start playing free

  1. 8 bits
  2. 32 bits ✔
  3. 256 bits

Why: NIST SP 800-63B-4 requires a salt of at least 32 bits. The goal is that accounts almost never share a salt, so the same password rarely gives the same stored hash.

Huh, didn't know that: NIST also says to store both the salt value and the resulting hash for each password.

The dad joke
My computer said my password is insecure. Well maybe if it wasn't forced to have such strict requirements it would be more confident.
Like this card?
Play the game

References

Answer: 32 bits. NIST SP 800-63B-4 requires a salt of at least 32 bits. The goal is that accounts almost never share a salt, so the same password rarely gives the same stored hash.

  1. NIST SP 800-63B-4, Authentication and Authenticator Management pages.nist.gov/800-63-4/sp800-63b.html
    The salt SHALL be at least 32 bits in length
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyAdding a unique random salt to each password before hashing mainly defends against what?Security & PrivacyWhich of these is a poor choice for storing passwords because it is a fast hash?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?

That's stuff everyone should know.