The salt is not secret. It stops precomputed tables and makes the attacker work on each account separately.