Rainbow table

What it means

A rainbow table is a precomputed structure that helps an attacker turn password hashes back into passwords. It is a space-saving way to store the results of hashing a huge number of likely passwords, so a lookup takes seconds instead of the time needed to hash them all again.

It works only when the same input always gives the same hash. If two users share a password and your system stores no salt, both rows show the same hash, and one table lookup reveals both. A salt breaks that link, because the same password then produces different hashes.

Why it matters

Password databases leak. When one does, the question is how quickly the attacker can turn hashes into working passwords, which people often reuse elsewhere. Unsalted fast hashes such as plain MD5 or SHA-1 can be reversed at scale, which feeds credential stuffing.

The fix is cheap and well known, so finding unsalted hashes during a review reflects poorly on the team. MITRE tracks the flaw as CWE-759, use of a one-way hash without a salt. Rotating to a stronger scheme at next login fixes old accounts without a mass reset.

How it shows up

A unique random salt for each password makes the precomputed table useless, because the attacker would need a separate table for every salt. Better still, use a purpose-built slow algorithm such as Argon2 or bcrypt, which add a salt and a cost setting. The OWASP password storage cheat sheet recommends them.

Salts stop rainbow tables, but they do not make a weak password strong. A salted fast hash can still be guessed at high speed with graphics cards, which is why the slow algorithms matter too. Check how your application stores passwords, and whether old accounts still use an older scheme that was never upgraded.