When a service’s password database leaks, the passwords inside are usually not stored as plain text — they are stored as hashes. So why do weak ones still get cracked in seconds? Often the answer is a rainbow table: a clever shortcut that turns “reverse this hash” into a quick lookup. Our GetMyPassword team explains what a rainbow table is and why salting defeats it.
First, how password hashes work
Good services do not store your actual password. They store a hash — a scrambled fingerprint produced by a one-way function. You cannot reverse a hash directly, so to find the password behind one, an attacker normally has to guess a candidate, hash it, and see if it matches. Do that for millions of guesses and it adds up. A rainbow table exists to skip almost all of that work.
What a rainbow table is
A rainbow table is a giant precomputed list that maps hashes back to the passwords that produce them. Someone does the hashing work ahead of time for huge numbers of possible passwords and stores the results in a compact form. Then, when an attacker steals a database of hashes, they do not compute anything — they just look up each stolen hash in the table and read off the matching password. It trades storage space for speed, turning hours of cracking into an instant search.
Why salting defeats it
The cure is a salt: a unique random value added to each password before it is hashed. Because every user gets a different salt, the same password produces a different hash for each person — so a precomputed table built for “plain” passwords matches nothing. The attacker is forced back into slow, one-at-a-time guessing, and the rainbow table becomes useless. This is why any competent service salts its hashes, and why a leaked hash is far less dangerous when it is salted.
A rainbow table is a cheat sheet of answers. A salt rewrites every question so the cheat sheet is worthless — which is exactly why salting is standard practice.
What it means for you
- You cannot control how a service hashes — but you can control your password.
- A long, random password may not appear in any precomputed table at all.
- A unique password per account means a cracked hash on one site does not unlock the others.
- Two-factor authentication blocks an attacker even if one password is recovered.
You will never see the hashing happening behind the scenes, but you decide what gets hashed. Give every account a long, random password from our password generator, keep each one unique, and turn on two-factor authentication. Then even a stolen, cracked hash leads nowhere.
Frequently asked questions
What is a rainbow table?
It is a precomputed list that maps password hashes back to the passwords that create them. An attacker with stolen hashes looks each one up instead of computing guesses, cracking weak passwords almost instantly.
How does salting stop a rainbow table?
A salt is a unique random value added to each password before hashing, so the same password hashes differently for every user. That makes precomputed tables useless and forces attackers back into slow, one-at-a-time guessing.
How do I protect my password from this?
Use a long, random password that is unlikely to be in any precomputed table, keep it unique to each account, and turn on two-factor authentication. Then a cracked hash on one service cannot open your other accounts.