If an Hacker get salt and our hashed password from a database, why can't he hack the password?

Question

They say salting a password and then hashing it will be far more secure. We all Know that passwords are salted and then hashed, eventually get stored in databases. During Data breaches a hacker can get password(salted and hashed) along with salt because salt is also stored in the databases for validation purpose. Then why it is not easy to crack if the hacker can get both salt and password which is salted and hashed? I thought that after getting the salt a hacker can found what password(salted and hashed) is it and then he can remove the salt from it to get the original password!

consider for example:(this is how I am thinking the things are happening) my password: Harivignesh123 salt to be added : 1$2$3

my new salted pass could be : Harivignesh1231$2$3

In database: password(salted and hashed) : 8a84dbd1ab769dfdeaf389a38a91feb7f0a3d9ea5e34254775dd66a5b82a402d salt: 1$2$3

After hacker got data from data breach: by some method( may be using hashcat) he found that my password is : Harivignesh1231$2$3 he also know that my salt is(because it is also stored in database): 1$2$3

so he can remove 1$2$3(salt) from the password and yeah he found it right? is it that easy? then how could it be more secure as they say! or salting is just to make sure every password is unique?

Help this newbie to come over this doubt and please point out if I am wrong with my thinking and thank you very much for your explanation in advance!

Answer 1

Because users pick predictable passwords, and there are databases of hashes for likely passwords - NIST quote an entropy figure of 4-bits per character. These databases are called Rainbow tables. Using a salt means the attacker needs to compute all the hashes again using the salted value.

Answer 2

The "by some method" is the crux here, it is not possible to revers a hash to its original password. What hashcat does, is to try millions of possible passwords and check if they result in the stolen hash.

With a long salt (much longer than in your example) it is not possible to precalculate all those hashes in a single rainbow-table, to later get the password quickly. Salted passwords like Harivignesh123mI82hjHHw1QwertxcvgZP0 would require way too many combinations/time.

Thus by salting, the attacker could build a rainbow-table only after knowing the salt, and then the rainbow-table can be used only for this salt. Because one uses a unique salt for each password, a rainbow-table could find onyl a single password.

If you want to know more about this topic, you can have a look at my tutorial about safely storing passwords.