Password Hashing

Never store plaintext passwords. Always hash them with a slow, salted algorithm. bcrypt is the standard choice for Node.js.

Why bcrypt?

• Incorporates a salt automatically (prevents rainbow table attacks)
• Configurable work factor (saltRounds) — higher = slower = more secure
• Designed to be slow: a work factor of 12 takes ~300ms, making brute-force expensive

const bcrypt = require('bcrypt')

// Hashing (async)
async function hashPassword(password) {
  const saltRounds = 12
  const hash = await bcrypt.hash(password, saltRounds)
// ...

Never store plaintext passwords. Always hash them with a slow, salted algorithm. bcrypt is the standard choice for Node.js.

Why bcrypt?

• Incorporates a salt automatically (prevents rainbow table attacks)
• Configurable work factor (saltRounds) — higher = slower = more secure
• Designed to be slow: a work factor of 12 takes ~300ms, making brute-force expensive

const bcrypt = require('bcrypt')

// Hashing (async)
async function hashPassword(password) {
  const saltRounds = 12
  const hash = await bcrypt.hash(password, saltRounds)
// ...