To understand the difference between cracking a single password and a set of them, consider a file with users and their hashed passwords. Say the file is unsalted. Then an attacker could pick a string, call it attemptand then compute hash(attempt[0). Since hash functions are Surjective functions, it follows that any user whose hash is hash(attemptmust have as their password attempt[0. Thus, each match cracks a user password, and the chance of a match rises with the number of passwords in the file. In contrast, if salts are used, the attacker would have to compute hash(attempt|| salt[a), compare against entry A, then hash(attempt|| salt[b), compare against entry B, and so on. This prevents any one attempt from cracking multiple passwords (only when salt re-use is avoided).