Skip to content

📰 Topic | Password Hashing by Aidan

Jump to bottom
Naomi Cheung edited this page Mar 30, 2021 · 1 revision

Password hashing

I chose password hashing because our app requires a login and register system in order to work correctly and securely. password hashing helps keep the passwords of individual users save.

What is password hashing

Hashing on it's own is a one-way function that scrambles data, it takes plain text (like a password or other classified data) and turns it into a completely different string of characters with a specific length; no matter the length of the password, the hash will always have the same character length.

Bcrypt

I chose Bcrypt for hashing passwords because other hashing methods like SHA1 and MD5 are relatively weak forms of hashing (it's easier to crack). Bcrypt makes the hashing process more secure by adding 'salt'. The 'salt' adds a few random characters, that are known to nobody, to your password, and they are also run through a hashing function.

Code Examples Here I hash the password that is in the plainTextPassword with 10 rounds of salt, 10 rounds of salt equals ~10 hashes/sec

const password = await bcrypt.hash(plainTextPassword, 10)

Here I compare the hash of the user who is trying to log in and the hash that is in the database. If they passwords match the user logs in to the homepage otherwise it will display a pop-up with "invalid username/password".

 if (await bcrypt.compare(password, user.password))

Sources

Clone this wiki locally