How can rainbow tables be defeated?

A rainbow table is a precomputed lookup table mapping hash values back to plaintext passwords. Salting appends a unique random string (the salt) to each password before hashing, so two users with identical passwords produce completely different hashes. Because the salt is unique per credential, an attacker would need to rebuild the entire rainbow table for every possible salt value, making the attack computationally infeasible.

Avoiding dictionary words protects against dictionary and brute-force attacks but does not prevent a rainbow table lookup if the hash of that complex password was precomputed.

Using all uppercase characters reduces the character set and is trivially accommodated by including uppercase variants in a rainbow table; it does not defeat the precomputed-table attack.

Account lockout mitigates online brute-force attempts against a live authentication service but has no effect on offline rainbow table attacks against a stolen hash database.