Does FusionAuth use a random salt for each password in Salted PBKDF2 HMAC SHA-256?

60 Views Asked by At

I am trying to find if FusionAuth uses a random salt for hashing algorithm in Salted PBKDF2 HMAC SHA-256

1

There are 1 best solutions below

0
robotdan On BEST ANSWER

A new salt is generated when the user is initially created, and each time the password is changed.

The salt is 32 bytes in length. The one exception to this is bcrypt which uses a 16 byte salt.

The only time the salt can be provided by the end user is on the Import API.