title: BCrypt generated + hard-coded Salt: Is this more safety?
body: <p>I found a blog post about BCrypt and I'am not sure what is the Benefit ob adding the hard-coded Salt "^Y8~JJ" to the password?</p>
  
  <p>The 'hashToStoreInDatabase' containing the salt and the crypted password, but not the hard-coded salt 'Y8~JJ'. So, if somebody steal the database it's   useless for the hacker to generate an own rainbowtable with the salt (containing in the database) and the hashed password, because they never get the hard-coded salt 'Y8~JJ'.</p>
  
  <p>(I knew that is already safety to save the salt and passwordhash togheter, because a rainbowtable is expencive to generate)</p>
  
  <p>Is this using of BCrypt recommended?</p>
  
  <p>Quote from: <a href="https://www.codeproject.com/articles/475262/useplusbcryptplustoplushashplusyourpluspasswords" rel="nofollow noreferrer">https://www.codeproject.com/articles/475262/useplusbcryptplustoplushashplusyourpluspasswords</a></p>
  
  <pre><code>private void SetPassword(string user, string userPassword)
  {
     string pwdToHash = userPassword + "^Y8~JJ"; // ^Y8~JJ is my hard-coded salt
     string hashToStoreInDatabase = BCrypt.HashPassword(pwdToHash, BCrypt.GenerateSalt());
     using (SqlConnection sqlConn = new System.Data.SqlClient.SqlConnection(...)
     {
       sqlConn.Open();
       SqlCommand cmSql = sqlConn.CreateCommand();
       cmSql.CommandText = "UPDATE LOGINS SET PASSWORD=@parm1 WHERE USERNAME=@parm2";
       cmSql.Parameters.Add("@parm1", SqlDbType.Char);
       cmSql.Parameters.Add("@parm2", SqlDbType.VarChar);
       cmSql.Parameters["@parm1"].Value = hashToStoreInDatabase;
       cmSql.Parameters["@parm2"].Value = user;
       cmSql.ExecuteNonQuery();
     }
   }
  
  private bool DoesPasswordMatch(string hashedPwdFromDatabase, string userEnteredPassword)
  {
      return BCrypt.CheckPassword(userEnteredPassword + "^Y8~JJ", hashedPwdFromDatabase);
  }
  </code></pre>