title: Password Management - Approach to Hash, Salt & Iteration
body: <p>Have gone through several questions on this topic at SO, and am unable to find answers to this specific query. I've seen
  <a href="https://stackoverflow.com/questions/674904/salting-your-password-best-practices">Salting Your Password: Best Practices?</a> and the excellent answer to <a href="https://stackoverflow.com/questions/536584/non-random-salt-for-password-hashes/536756#536756">Non-random salt for password hashes</a>, which both have very helpful guidelines, but doesn't have a clear guideline on storage.</p>
  
  <p>Is it advisable to have the hash, random salt and iteration count all in the same table? If not, what is a suggested approach?</p>
  
  <p>I do understand that rainbow tables can't be made easily with random salts in place, even if we have them together. The question is because there are many simple extra deterrents that can go a long way. For example, have the salt in a different table (injections usually leach a table, not a DB) and the iteration count in a different tier (say, a constant in mid-tier).</p>