title: Why does PHP crypt() prepend the salt to the hash?
body: <p>I am looking into building a login system and after reading the php manual when you pass a 2 digit salt to the <code>crypt()</code> function it returns a hash string, and the first 2 digits of the string are the salt that you used.</p>
  
  <p>example:</p>
  
  <pre><code>$salt = "kr";
  echo crypt("mysecret",$salt); //returns "kreOI.F7eOQMY"
  </code></pre>
  
  <p>My first thought was, wouldn't this help someone who is trying to reverse your hash?</p>
  
  <p>I looked up <a href="http://en.wikipedia.org/wiki/Salt_(cryptography)" rel="noreferrer">salt</a> on wikipedia which said:</p>
  
  <blockquote>
    <p>For best security, the salt value is kept secret.</p>
  </blockquote>
  
  <p>So I do not understand why then would the crypt function return all hashes prepended with the salt value used?</p>
  
  <p>Is there a reason for this? Should this be a security concern?</p>