Password Hashing (bcrypt)

Password hashing is an essential security practice used to protect user passwords in databases.

bcrypt is one of the most popular libraries used in Node.js for securely hashing passwords.

What is Password Hashing?

Password hashing converts plain-text passwords into unreadable strings using cryptographic algorithms.

Hashed passwords cannot be easily reversed back to their original form.

Why Password Hashing is Important

Storing plain-text passwords is extremely dangerous because attackers can directly access user credentials if the database is compromised.

Hashing protects user passwords even if unauthorized access occurs.

What is bcrypt?

bcrypt is a password hashing library designed specifically for securely storing passwords.

It automatically handles salting and provides strong resistance against brute-force attacks.

Installing bcrypt

npm install bcrypt

bash

Importing bcrypt

const bcrypt = require('bcrypt');

javascript

Hashing a Password

Passwords are hashed before storing them in the database.

const password = 'mySecret123';

bcrypt.hash(password, 10, (err, hash) => {
  console.log(hash);
});

javascript

The second parameter represents salt rounds, which control hashing complexity.

Understanding Salt

A salt is a random value added to passwords before hashing.

Salting prevents attackers from using precomputed rainbow tables to crack passwords.

Comparing Passwords

bcrypt provides a compare method to verify passwords during login.

bcrypt.compare('mySecret123', hashedPassword, (err, result) => {
  console.log(result);
});

javascript

The compare method checks whether the entered password matches the stored hash.

Using Async/Await with bcrypt

bcrypt also supports async/await syntax for cleaner asynchronous code.

const hashPassword = async () => {
  const hash = await bcrypt.hash('password123', 10);
  console.log(hash);
};

javascript

Verifying Login Credentials

During authentication, the entered password is compared against the hashed password stored in the database.

const isMatch = await bcrypt.compare(password, user.password);

javascript

Integrating bcrypt with Express.js

bcrypt is commonly used in registration and login APIs built with Express.js.

app.post('/register', async (req, res) => {
  const hashedPassword = await bcrypt.hash(req.body.password, 10);

  res.send('User Registered');
});

javascript

Password Security Best Practices

Always hash passwords before storing them in the database.

Use strong password policies and secure HTTPS connections.

Choosing Salt Rounds

Higher salt rounds increase security but also increase processing time.

A value between 10 and 12 is commonly used in production applications.

Common Beginner Mistakes

Beginners often store passwords directly without hashing them.

Another common mistake is exposing hashed passwords in API responses.

Difference Between Encryption and Hashing

Encryption can be reversed using a key, while hashing is designed to be one-way.

Passwords should be hashed instead of encrypted for better security.

Advantages of bcrypt

bcrypt automatically generates salts and provides built-in protection against brute-force attacks.

It is trusted and widely used in production-level applications.

Real-World Importance

Secure password hashing is a critical requirement for modern authentication systems.

Most professional backend applications rely on bcrypt or similar hashing libraries for password security.

Summary

bcrypt helps developers securely hash and verify passwords in Node.js applications.

Understanding password hashing is essential for building secure authentication systems.