Pepper

A pepper is a long, application-wide secret (typically 32 bytes or more) added to every password before it is processed by a hash function or KDF, in addition to the per-user salt. Unlike a salt, a pepper is stored outside the user-credentials database — for example in a configuration file, environment variable, or hardware security module — so that an attacker who only obtains the hash table cannot easily crack passwords offline. Implementations commonly use HMAC(pepper, password) before passing the result into Argon2id, or feed the pepper through a KDF as part of the secret material. Peppering is a defence-in-depth measure: it should never replace strong KDFs, salts, or rate limiting, but it raises the cost of database-only breaches.