Password Peppering

Also Known As

TL;DR

Explanation

A pepper is a secret value (distinct from a salt) that is the same for all users, stored outside the database (environment variable, secrets manager, HSM) and concatenated with the password before hashing. If an attacker steals the database, they have hashes and salts but not the pepper — offline cracking is impossible without it. In PHP, prepend or HMAC the pepper before password_hash(): $peppered = hash_hmac('sha256', $password, $pepper); password_hash($peppered, PASSWORD_ARGON2ID). Rotate peppers by re-hashing on next login.

Watch Out

Common Misconception

Why It Matters

Common Mistakes

• Storing the pepper in the database alongside the hashes — defeats the entire purpose.
• Using a hardcoded pepper in source code that is committed to version control.
• Using HMAC-then-hash rather than hash(password + pepper) — the order and method matters for security properties.
• Not planning for pepper rotation — changing the pepper requires re-hashing all passwords at next login.

Code Examples

// Pepper stored in the same DB as hashes:
$pepper = $db->query('SELECT value FROM config WHERE key = "pepper"');
$hash = password_hash($password . $pepper, PASSWORD_BCRYPT);
// Database breach reveals both the hash and the pepper

// Pepper is an application-level secret added before hashing
// Unlike salt (stored in DB), pepper is in environment config
// A compromised DB dump is useless without the pepper

\$pepper  = \$_ENV['PASSWORD_PEPPER']; // e.g. 64-char random string
\$peppered = hash_hmac('sha256', \$plaintext, \$pepper);
\$hash     = password_hash(\$peppered, PASSWORD_ARGON2ID);

// Verify
\$peppered = hash_hmac('sha256', \$input, \$pepper);
if (password_verify(\$peppered, \$storedHash)) { /* authenticated */ }

// Rotate pepper: add new pepper env var, re-hash on next successful login

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#peppering

Tags

Related Terms