How can rainbow tables be defeated?

Rainbow tables are precomputed tables mapping hash values back to plaintext passwords. Salting adds a unique random string to each password before it is hashed, so even identical passwords produce different hashes. This means an attacker would need a separate rainbow table for every possible salt value, which is computationally infeasible.

Non-dictionary words help against dictionary attacks but not rainbow tables, which can contain hashes of arbitrary strings including non-dictionary words if the table is large enough.

Using all uppercase characters merely reduces the character set and does not prevent rainbow table lookups since tables can be built for any character set.

Account lockout policies mitigate online brute force attacks but are irrelevant against rainbow table attacks, which are performed offline against stolen hash databases.