The bcrypt npm package is a library for hashing and comparing passwords securely in Node.js. It implements the bcrypt password-hashing function, which is designed to build a cryptographic hash of a user's password. Bcrypt is widely used due to its security features and resistance to brute-force attacks.
Hashing Passwords
This feature allows you to securely hash a plaintext password. The 'saltRounds' parameter defines the cost factor for the hashing process, which determines the amount of time required to calculate a single bcrypt hash.
const bcrypt = require('bcrypt');
const saltRounds = 10;
const myPlaintextPassword = 's0/\/\P4$$w0rD';
bcrypt.hash(myPlaintextPassword, saltRounds, function(err, hash) {
// Store hash in your password DB.
});Comparing Passwords
This feature is used to compare a plaintext password against a previously hashed one to check if they match. It is commonly used during the login process to validate user credentials.
const bcrypt = require('bcrypt');
const myPlaintextPassword = 's0/\/\P4$$w0rD';
const someOtherPlaintextPassword = 'not_bacon';
const hash = '$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy';
bcrypt.compare(myPlaintextPassword, hash, function(err, result) {
// result == true
});
bcrypt.compare(someOtherPlaintextPassword, hash, function(err, result) {
// result == false
});Argon2 is another password hashing library that won the Password Hashing Competition and is recommended for new applications. It is considered to be more resistant to GPU cracking attacks compared to bcrypt.
Scrypt is a password-based key derivation function that is designed to be costly in both time and memory, making it hard to perform large-scale custom hardware attacks. It is similar to bcrypt but with a focus on memory-intensiveness.
PBKDF2 (Password-Based Key Derivation Function 2) is part of RSA Laboratories' Public-Key Cryptography Standards (PKCS) series, and it's widely used for password hashing. It's not as secure as bcrypt for password storage because it's more vulnerable to GPU attacks.
Lib to help you hash passwords.
bcrypt on wikipedia
Catalyst: How To Safely Store A Password
npm install bcrypt
Assuming you've already built node, you can run the waf script:
node-waf configure
node-waf build
npm link
To hash a password:
var bcrypt = require('bcrypt');
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync("B4c0//", salt);
To check a password:
var bcrypt = require('bcrypt');
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync("B4c0//", salt);
bcrypt.compare_sync("B4c0//", hash); // true
bcrypt.compare_sync("not_bacon", hash); // false
To hash a password:
var bcrypt = require('bcrypt');
bcrypt.gen_salt(10, function(err, salt) {
bcrypt.encrypt("B4c0//", salt, function(err, hash) {
//something
});
});
To check a password:
var bcrypt = require('bcrypt');
bcrypt.gen_salt(10, function(err, salt) {
bcrypt.encrypt("B4c0//", salt, function(err, hash) {
bcrypt.compare("B4c0//", hash, function(err, res) {
// res == true
});
bcrypt.compare("not_bacon", hash, function(err, res) {
// res = false
});
});
});
The characters that comprise passwords are ./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$.
I am using nodeunit. I like the way you write tests with it and I like the default output. As such you'll need it to run the tests. I suspect my tests would run on an older version, but these were written and worked against 0.5.1 npm install nodeunit@0.5.1 nodeunit test/
The code for this comes from a few sources:
Unless stated elsewhere, file headers or otherwise, the license as stated in the LICENSE file.
v0.2.3
FAQs
A bcrypt library for NodeJS.
The npm package bcrypt receives a total of 833,816 weekly downloads. As such, bcrypt popularity was classified as popular.
We found that bcrypt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
RubyGems.org has added a new "maintainer" role that allows for publishing new versions of gems. This new permission type is aimed at improving security for gem owners and the service overall.
Security News
Node.js will be enforcing stricter semver-major PR policies a month before major releases to enhance stability and ensure reliable release candidates.
Security News
Research
Socket's threat research team has detected five malicious npm packages targeting Roblox developers, deploying malware to steal credentials and personal data.