Hacker News Reader

If we use the global pepper for hashing, we can’t easily rotate it.

I don't get this point. Why is it harder to rotate pepper for a hash compared to an encryption key?

Because encryption can be decrypted with the correct key. A hash can't be reversed once you've hashed something with the pepper.

Hmm. Ok. That's true. Thanks!

You'd have to recalculate hashes for every user?