title: Is time() a good salt?
body: <p>I'm looking at some code that I have not written myself. The code tries to hash a password with SHA512 and uses just <code>time()</code> as the salt. Is <code>time()</code> too simple a salt for this or is this code safe?</p>
  
  <p>Thanks for the answers and comments. I will sum it up here for the new readers:</p>
  
  <ul>
  <li>salt should be different for each user, so if 2 users register at the same time, their salts won't be unique. This is a problem, but not a big one. </li>
  <li>but salt shouldn't be in any way related to the user, so time() is not a good salt. </li>
  <li>"<em>Use a random, evenly distributed, high entropy salt.</em>" -- That's a mouthful, so what code could possibly generate a <code>random, evenly distributed, high entropy</code> salt?</li>
  </ul>
  
  <p>Ok, so how about I replace time() with a random string 32 char long. The random string could be generated from looping 32 times over a set of alphabet chars. Does that sound good?</p>