Hacker News Reader

If the attacker has one known password in the database, finding the pepper has the same difficulty as finding one password in a DB without pepper.

View on HN

That is not entirely true: the pepper is usually randomly generated, so a "smart" brute-forcing tool (using combinations and substitutions on a base corpus) will have a much harder time matching something.

Reply on news.ycombinator.com