How to hash passwords using bcrypt in Node js

Question

Bcrypt is a popular hashing algorithm for securely storing passwords. What is the correct way to hash and verify passwords using bcrypt in a Node.js application?

Answer 1

Bcrypt is a widely-used library for hashing passwords in Node.js applications, offering a robust way to securely store user credentials. Here's how you can hash and verify passwords using bcrypt:

1. Installing bcrypt

First, install the bcrypt library using npm:

npm install bcrypt

2. Hashing a Password

To hash a password, follow these steps:

• Import bcrypt: Include the bcrypt library in your project.

• Generate a Salt: A salt adds randomness to the hashing process, making it more secure.

• Hash the Password: Combine the password with the salt to create the hash.

Here's an example:

const bcrypt = require('bcrypt');

const saltRounds = 10; // Number of salt rounds

const hashPassword = async (plainPassword) => {
  try {
    const salt = await bcrypt.genSalt(saltRounds);
    const hash = await bcrypt.hash(plainPassword, salt);
    return hash;
  } catch (error) {
    console.error('Error hashing password:', error);
  }
};

// Usage
const plainPassword = 'yourPassword123';
hashPassword(plainPassword).then((hashedPassword) => {
  console.log('Hashed Password:', hashedPassword);
});

3. Verifying a Password

To verify a user's password during login, compare the provided password with the stored hash:

const bcrypt = require('bcrypt');

const verifyPassword = async (plainPassword, hashedPassword) => {
  try {
    const match = await bcrypt.compare(plainPassword, hashedPassword);
    return match;
  } catch (error) {
    console.error('Error verifying password:', error);
  }
};

// Usage
const plainPassword = 'yourPassword123';
const hashedPassword = 'storedHashedPasswordFromDB';

verifyPassword(plainPassword, hashedPassword).then((isMatch) => {
  if (isMatch) {
    console.log('Password is correct!');
  } else {
    console.log('Password is incorrect.');
  }
});

4. Synchronous vs. Asynchronous Methods

Bcrypt provides both synchronous and asynchronous methods. Asynchronous methods are preferred in production environments to avoid blocking the event loop. However, for simplicity or in scripts where blocking isn't a concern, synchronous methods can be used:

const bcrypt = require('bcrypt');

const saltRounds = 10;
const plainPassword = 'yourPassword123';

// Synchronous hashing
const salt = bcrypt.genSaltSync(saltRounds);
const hash = bcrypt.hashSync(plainPassword, salt);
console.log('Hashed Password:', hash);

// Synchronous verification
const isMatch = bcrypt.compareSync(plainPassword, hash);
console.log('Password match:', isMatch);

5. Choosing the Number of Salt Rounds

The saltRounds parameter determines the computational complexity of the hashing process. A higher number increases security but also requires more processing time. Common practice is to use a value between 10 and 12. It's essential to balance security needs with application performance.

6. Use Cases

• User Registration: Hash the user's password before storing it in the database to ensure that even if the database is compromised, the actual passwords remain protected.

• User Login: When a user attempts to log in, hash the provided password and compare it to the stored hash. If they match, authentication is successful.

7. Security Considerations

• Avoid Hardcoding Salts: Always generate a new salt for each password to ensure uniqueness.

• Regularly Update Dependencies: Keep the bcrypt library up-to-date to incorporate the latest security patches and improvements.

• Handle Errors Gracefully: Implement proper error handling to maintain application stability and security.

By following these practices, you can effectively use bcrypt to enhance the security of password management in your Node.js applications.