What is bcrypt?
The bcrypt npm package is a library for hashing and comparing passwords securely in Node.js. It implements the bcrypt password-hashing function, which is designed to build a cryptographic hash of a user's password. Bcrypt is widely used due to its security features and resistance to brute-force attacks.
What are bcrypt's main functionalities?
Hashing Passwords
This feature allows you to securely hash a plaintext password. The 'saltRounds' parameter defines the cost factor for the hashing process, which determines the amount of time required to calculate a single bcrypt hash.
const bcrypt = require('bcrypt');
const saltRounds = 10;
const myPlaintextPassword = 's0/\/\P4$$w0rD';
bcrypt.hash(myPlaintextPassword, saltRounds, function(err, hash) {
// Store hash in your password DB.
});
Comparing Passwords
This feature is used to compare a plaintext password against a previously hashed one to check if they match. It is commonly used during the login process to validate user credentials.
const bcrypt = require('bcrypt');
const myPlaintextPassword = 's0/\/\P4$$w0rD';
const someOtherPlaintextPassword = 'not_bacon';
const hash = '$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy';
bcrypt.compare(myPlaintextPassword, hash, function(err, result) {
// result == true
});
bcrypt.compare(someOtherPlaintextPassword, hash, function(err, result) {
// result == false
});
Other packages similar to bcrypt
argon2
Argon2 is another password hashing library that won the Password Hashing Competition and is recommended for new applications. It is considered to be more resistant to GPU cracking attacks compared to bcrypt.
scrypt
Scrypt is a password-based key derivation function that is designed to be costly in both time and memory, making it hard to perform large-scale custom hardware attacks. It is similar to bcrypt but with a focus on memory-intensiveness.
pbkdf2
PBKDF2 (Password-Based Key Derivation Function 2) is part of RSA Laboratories' Public-Key Cryptography Standards (PKCS) series, and it's widely used for password hashing. It's not as secure as bcrypt for password storage because it's more vulnerable to GPU attacks.
node.bcrypt.js
Lib to help you hash passwords.
bcrypt on wikipedia
Catalyst for this module: How To Safely Store A Password
Version Compatability
Node Ver | Bcrypt Version |
<= 0.4.x | <= 0.4.x |
>= 0.6.x | >= 0.5.x |
Security Issues/Concerns
As should be the case with any security tool, this library should be scrutinized by anyone using it. If you find or suspect an issue with the code- please bring it to my attention and I'll spend some time trying to make sure that this tool is as secure as possible.
To make it easier for people using this tool to analyze what has been surveyed, here is a list of BCrypt related security issues/concerns as they've come up.
- An issue with passwords was found with a version of the Blowfish algorithm developed for John the Ripper. This is not present in the OpenBSD version and is thus not a problem for this module. HT zooko.
Dependencies
- NodeJS
- OpenSSL (Development Libraries (header files) for compilation)
From NPM
npm install bcrypt
From Source
Assuming you've already built node, you can compile the module with node-gyp
:
git clone git://github.com/ncb000gt/node.bcrypt.js.git
cd node.bcrypt.js
node-gyp configure
node-gyp build
Note: if you do not have node-gyp installed, install it using: npm install -g node-gyp
Usage - Sync
To hash a password:
var bcrypt = require('bcrypt');
var salt = bcrypt.genSaltSync(10);
var hash = bcrypt.hashSync("B4c0/\/", salt);
// Store hash in your password DB.
To check a password:
// Load hash from your password DB.
bcrypt.compareSync("B4c0/\/", hash); // true
bcrypt.compareSync("not_bacon", hash); // false
Auto-gen a salt and hash:
var hash = bcrypt.hashSync('bacon', 8)
Usage - Async
To hash a password:
var bcrypt = require('bcrypt');
bcrypt.genSalt(10, function(err, salt) {
bcrypt.hash("B4c0/\/", salt, function(err, hash) {
// Store hash in your password DB.
});
});
To check a password:
// Load hash from your password DB.
bcrypt.compare("B4c0/\/", hash, function(err, res) {
// res == true
});
bcrypt.compare("not_bacon", hash, function(err, res) {
// res = false
});
Auto-gen a salt and hash:
bcrypt.hash('bacon', 8, function(err, hash) {
});
API
BCrypt.
genSaltSync(rounds, seed_length)
rounds
- [OPTIONAL] - the number of rounds to process the data for. (default - 10)seed_length
- [OPTIONAL] - RAND_bytes wants a length. to make that a bit flexible, you can specify a seed_length. (default - 20)
genSalt(rounds, seed_length, cb)
rounds
- [OPTIONAL] - the number of rounds to process the data for. (default - 10)seed_length
- [OPTIONAL] - RAND_bytes wants a length. to make that a bit flexible, you can specify a seed_length. (default - 20)cb
- [REQUIRED] - a callback to be fired once the salt has been generated. uses eio making it asynchronous.
err
- First parameter to the callback detailing any errors.salt
- Second parameter to the callback providing the generated salt.
hashSync(data, salt)
data
- [REQUIRED] - the data to be encrypted.salt
- [REQUIRED] - the salt to be used in encryption.
hash(data, salt, cb)
data
- [REQUIRED] - the data to be encrypted.salt
- [REQUIRED] - the salt to be used to hash the password. if specified as a number then a salt will be generated and used (see examples).cb
- [REQUIRED] - a callback to be fired once the data has been encrypted. uses eio making it asynchronous.
err
- First parameter to the callback detailing any errors.encrypted
- Second parameter to the callback providing the encrypted form.
compareSync(data, encrypted)
data
- [REQUIRED] - data to compare.encrypted
- [REQUIRED] - data to be compared to.
compare(data, encrypted, cb)
data
- [REQUIRED] - data to compare.encrypted
- [REQUIRED] - data to be compared to.cb
- [REQUIRED] - a callback to be fired once the data has been compared. uses eio making it asynchronous.
err
- First parameter to the callback detailing any errors.same
- Second parameter to the callback providing whether the data and encrypted forms match [true | false].
getRounds(encrypted)
- return the number of rounds used to encrypt a given hash
encrypted
- [REQUIRED] - hash from which the number of rounds used should be extracted.
Hash Info
The characters that comprise the resultant hash are ./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789$
.
Testing
I am using nodeunit. I like the way you write tests with it and I like the default output. As such you'll need it to run the tests. I suspect my tests would run on an older version, but these were written and worked against 0.5.1
npm install nodeunit@0.5.1
nodeunit test/
Credits
The code for this comes from a few sources:
Contributors
License
Unless stated elsewhere, file headers or otherwise, the license as stated in the LICENSE file.