hash - Salting Your Password: Best Practices?

Question

Closed. This question is opinion-based. It is not currently accepting answers.

Answer 1

Prefix or suffix is irrelevant, it's only about adding some entropy and length to the password.

You should consider those three things:

1. The salt has to be different for every password you store. (This is quite a common misunderstanding.)
2. Use a cryptographically secure random number generator.
3. Choose a long enough salt. Think about the birthday problem.

There's an excellent answer by Dave Sherohman to another question why you should use randomly generated salts instead of a user's name (or other personal data). If you follow those suggestions, it really doesn't matter where you put your salt in.