Salting Explained | Hacksplaining

Salting passwords can protect you from dictionary attacks in the event of a database leak. The salt should be used when generating a hashed value of a password for storage.

Without a salt, two users who choose the same password get the same hash. An attacker with a leaked database can then look up every hash at once in a rainbow table, a precomputed list of hashes for common passwords (see password lists). A unique, random salt for each password makes every hash different, so the attacker has to attack each password separately. The salt does not need to be secret, and it is stored alongside the hash. Libraries like bcrypt generate the salt and store it inside the hash for you:

import bcrypt

password = "ab9bb555-afc4-49f0-94cb-e58765e5693b"
salt     = bcrypt.gensalt()

# This is the value you should store in the database.
hashed = bcrypt.hashpw(password, salt)

# This is how you check a password once a re-enters is.
if bcrypt.checkpw(password, hashed):
  print("Password entered correctly")

Further Reading