How can rainbow tables be defeated?

A rainbow table is a precomputed database mapping common inputs to their hash values, allowing an attacker to reverse a stolen hash almost instantly. Salting prepends or appends a unique random string to each password before hashing, so even two identical passwords produce entirely different hash values. This forces an attacker to recompute a separate rainbow table for every unique salt, which is computationally infeasible and effectively neutralizes the attack.

Using non-dictionary words protects against dictionary and wordlist attacks, but rainbow tables can be precomputed for arbitrary character strings, so this does not defeat them.

Restricting passwords to all uppercase only marginally reduces the keyspace and does not prevent rainbow tables, which can be precomputed for any character set including uppercase-only inputs.

Account lockout prevents online brute-force attempts against a live login service but provides no protection against offline rainbow table attacks performed against a stolen password hash database.