What a salt does
A salt is random data mixed into a password before hashing. Because every user gets a different salt, two people with the same password end up with different hashes, and an attacker cannot use precomputed tables or crack every account at once. Salts are not secret: they are stored next to the hash.
16 bytes, or 128 bits, is the common recommendation for password hashing and key derivation salts, and is the default here.
You often do not need to make one
Modern password hashing libraries for bcrypt, Argon2 and scrypt create a salt automatically and store it inside the hash string. Generate salts yourself when you implement PBKDF2 or HKDF directly, configure a system that asks for one, or need test vectors.
Frequently asked questions
Should a salt be secret?
No. A salt only needs to be unique and random. An extra secret value kept outside the database is called a pepper.
Can I use one salt for all users?
No. A shared salt defeats the purpose. Each password hash needs its own random salt.