What is the best way to generate salt randomly or based on some user data?

Question

Information Security

The question is fully stated in the title.

Answer 1

And what is the point of using some kind of user data? Add more entropy to random?
With a good random it won't matter.

Answer 2

Salt cannot be random! Otherwise, you will not be able to check the data, generate the same salt.
Binding to user data is also a bad idea. It will change something, the salt will already be different - and the password was generated from the previous salt. Again, nothing matches.
In general, read what is Salt. It can be random at the very beginning, inventing. But then it remains constant and hides deep in the backend system. If the task is to change the salt, then first you must decrypt the data using the old salt and encrypt it with a new one. And replace it with a new constant.

Answer 3

For security , the "salt" is randomly generated and stored next to the password in the database. You can further complicate the algorithm by adding a secret value - "pepper" , which is stored separately.

Answer 4

Salt is not a secret parameter.
Its only purpose is to exclude the use of rainbow tables. To do this, the salt must be difficult to guess.
Because user data is so-so salt. It's better not to fool around and generate a random string of reasonable length. Store with hash.
Each password has its own separate salt.
All this is already implemented in the same Bcrypt password hashing algorithm .
A detailed answer to the question about hashing passwords was already given in this question:
What is the best way to encrypt passwords for saving in a DB?
The question of salt is also sorted out there.