How is the password salt stored?

Question

Information Security

Let's say we have hash functions through which passwords pass and "salt" is added. Identical passwords in the database will have a different salt, where the "salt" base is located, and whether it exists at all, or there is a special algorithm that finds the password from the hash with the salt. Thanks in advance.

Answer 1

Salt is needed only for one case - so that it is impossible to guess a password from a known hash database.
If, when generating a hash, a new salt is used each time, it may well lie in clear text next to the hash, or right in it (several characters at the beginning, end or middle). This allows you to create different hashes for identical passwords, create complex hashes for simple passwords, and makes it impossible to create a rainbow table for a specific resource. ppppp.ssssss
-> hhhhhhhhhhhhhhhhsssss (p - pass, s - salt, h - hash)
There is another scheme when everything is hashed with a specific master salt (for example, passwords in different forum engines), which allows you to store hashes separately from the salt (one salt for all hashes in config.php, and the hashes themselves in the database).
You can complicate the second option by adding a base of several salts, and each time iterate over them all on the server side. And the hashes will be stored in the database, in which the password with the salt is hashed, but the salt itself is not registered in the hash itself, and it is not clear which one was used for a particular hash. Increases security if only all hashes are leaked.
You can combine the first and second options, you can be paranoid in different ways.
ssspppppppsss -> hash(hash(hash(sssmastersalt.hhhhhhsss)+hash(hhhhhhhhhsss))
In general, it depends on the algorithm and the desire to complicate things.