How does using a system-wide salt (or "pepper") affect the security of password hashing in PHP?

Using a system-wide salt (or "pepper") in addition to user-specific salts can greatly enhance the security of password hashing in PHP. By adding a secret salt known only to the server, even if an attacker gains access to the hashed passwords, they would still need the system-wide salt to successfully crack them. This extra layer of security makes it much more difficult for attackers to use rainbow tables or brute force attacks to crack passwords.

// System-wide salt
define('SYSTEM_SALT', 'supersecretpepper123');

// User-specific salt
$userSalt = generateUserSalt(); // Function to generate user-specific salt

// Combine user salt with system salt
$combinedSalt = $userSalt . SYSTEM_SALT;

// Hash the password with the combined salt
$hashedPassword = password_hash($password . $combinedSalt, PASSWORD_DEFAULT);