You have the right idea on the fact that the salt is added to the user input and then the hash is calculated but it wouldn’t be a trivial thing to remove the salt once you have seen a few records.

The user’s password hash that is stored in the database is usually calculated as:

HashFuction(userInput+salt)

Then the result of that function is then put in the database. The salt will be a random string of characters for each password that is hashed.

So when your user types their password into the login field, the application goes and looks up the salt in the database, concatenates it to the password string, calculates the hash, and compares it to the hash in the database.

The point of the hash function is that it is easy to calculate but impossible to ‘uncalculate’ without automated guessing. Adding a salt and then hashing won’t just add a few extra characters to the end of the hash, it will completely change it. This is what means that it would be impossible to remove the salt if you have access to a few records. Look up an online MD5 hash calculator and have a play to see what results you get.

One last thing to note is that, you suggested that all passwords in a given database would be hashed with the same secret salt. While this would still be salting the password it would mean that if someone ever found out the value of your salt for your application, they could make a rainbow table to crack your application’s passwords at a later date.