• Seems the database would have two columns. One for Salt and one for HashedPassword. Then, you have your application do the hashing with the RANDOM salt. You store both in the database.

    Usually we can use the user ID column so that SALT will be unique for each user though more than one have same password.

    Reverse engineering a HashedPassword is difficult unless you already have several commonly used password that are in a table and you compare it with the HashedPassword column.

    Hashed password can never be reverse engineered (as in the case of encryption). The only possible way is bruteforce attack with the help of rainbow table. Ofcourse, there are other ways like capturing key stroke.

    Again this can further be controlled by limiting incorrect password attempts combined with strong hash algorithm.