diff --git a/config/passport.js b/config/passport.js
index 2268fb0..de19681 100644
--- a/config/passport.js
+++ b/config/passport.js
@@ -8,7 +8,7 @@ passport.serializeUser((user, done) => {
 
 passport.deserializeUser(async (id, done) => {
   try {
-    const user = await User.findById(id, '-password -salt')
+    const user = await User.findById(id, '-password')
     done(null, user)
   } catch(err) {
     done(err)
diff --git a/src/middleware/validators.js b/src/middleware/validators.js
index 1f35776..be25053 100644
--- a/src/middleware/validators.js
+++ b/src/middleware/validators.js
@@ -16,7 +16,7 @@ export async function ensureUser(ctx, next) {
     ctx.throw(401)
   }
 
-  const user = await User.findById(decoded.id, '-password -salt')
+  const user = await User.findById(decoded.id, '-password')
   if (!user) {
     ctx.throw(401)
   }
diff --git a/src/models/users.js b/src/models/users.js
index a78add1..51b1ed3 100644
--- a/src/models/users.js
+++ b/src/models/users.js
@@ -7,8 +7,7 @@ const User = new mongoose.Schema({
   type: { type: String, default: 'User' },
   name: { type: String },
   username: { type: String, required: true, unique: true },
-  password: { type: String, required: true },
-  salt: { type: String }
+  password: { type: String, required: true }
 })
 
 User.pre('save', function preSave(next) {
@@ -29,7 +28,6 @@ User.pre('save', function preSave(next) {
       if (err) { throw new Error(err) }
 
       user.password = hash
-      user.salt = salt
 
       next(null)
     })
diff --git a/src/modules/auth/controller.js b/src/modules/auth/controller.js
index 6965ff5..dce875b 100644
--- a/src/modules/auth/controller.js
+++ b/src/modules/auth/controller.js
@@ -64,7 +64,6 @@ export async function authUser(ctx, next) {
     const response = user.toJSON()
 
     delete response.password
-    delete response.salt
 
     ctx.body = {
       token,
diff --git a/src/modules/users/controller.js b/src/modules/users/controller.js
index f03cf64..c5332f1 100644
--- a/src/modules/users/controller.js
+++ b/src/modules/users/controller.js
@@ -50,8 +50,7 @@ export async function createUser(ctx) {
   const response = user.toJSON()
 
   delete response.password
-  delete response.salt
-
+  
   ctx.body = {
     user: response,
     token
@@ -86,7 +85,7 @@ export async function createUser(ctx) {
  * @apiUse TokenError
  */
 export async function getUsers(ctx) {
-  const users = await User.find({}, '-password -salt')
+  const users = await User.find({}, '-password')
   ctx.body = { users }
 }
 
@@ -119,7 +118,7 @@ export async function getUsers(ctx) {
  */
 export async function getUser(ctx, next) {
   try {
-    const user = await User.findById(ctx.params.id, '-password -salt')
+    const user = await User.findById(ctx.params.id, '-password')
     if (!user) {
       ctx.throw(404)
     }
diff --git a/test/auth.spec.js b/test/auth.spec.js
index fa9e5f8..95a8cc7 100644
--- a/test/auth.spec.js
+++ b/test/auth.spec.js
@@ -39,7 +39,6 @@ describe('Auth', () => {
           res.body.user.should.have.property('username')
           res.body.user.username.should.equal('test')
           expect(res.body.user.password).to.not.exist
-          expect(res.body.user.salt).to.not.exist
 
           context.user = res.body.user
           context.token = res.body.token
diff --git a/test/users.spec.js b/test/users.spec.js
index 99931ce..becef81 100644
--- a/test/users.spec.js
+++ b/test/users.spec.js
@@ -33,7 +33,6 @@ describe('Users', () => {
           res.body.user.should.have.property('username')
           res.body.user.username.should.equal('supercoolname')
           expect(res.body.user.password).to.not.exist
-          expect(res.body.user.salt).to.not.exist
 
           context.user = res.body.user
           context.token = res.body.token
@@ -99,7 +98,6 @@ describe('Users', () => {
           res.body.should.have.property('user')
 
           expect(res.body.user.password).to.not.exist
-          expect(res.body.user.salt).to.not.exist
 
           done()
         })
@@ -138,7 +136,6 @@ describe('Users', () => {
           res.body.user.should.have.property('username')
           res.body.user.username.should.equal('updatedcoolname')
           expect(res.body.user.password).to.not.exist
-          expect(res.body.user.salt).to.not.exist
 
           done()
         })