tormpath.com/blog/strong-password-hashing-apache-shiro">blog article explains in greater detail why this is useful, as well as information on how many iterations is 'enough'.
You may set the number of hash iterations via the {@link #setHashIterations(int)} property. The default is{@code 1}, but should be increased significantly if the {@code HashService} is intended to be used for passwordhashing. See the linked blog article for more info.
Private Salt
If using this implementation as part of a password hashing strategy, it might be desirable to configure a {@link #setPrivateSalt(ByteSource) private salt}:
A hash and the salt used to compute it are often stored together. If an attacker is ever able to access the hash (e.g. during password cracking) and it has the full salt value, the attacker has all of the input necessary to try to brute-force crack the hash (source + complete salt).
However, if part of the salt is not available to the attacker (because it is not stored with the hash), it is
much harder to crack the hash value since the attacker does not have the complete inputs necessary.
The {@link #getPrivateSalt() privateSalt} property exists to satisfy this private-and-not-shared part of the salt.If you configure this attribute, you can obtain this additional very important safety feature.
*By default, the {@link #getPrivateSalt() privateSalt} is null, since a sensible default cannot be used thatisn't easily compromised (because Shiro is an open-source project and any default could be easily seen and used).
@since 1.2