A Complete Guide - NodeJS bcrypt for Password Hashing

Step 1: Set Up Your Node.js Environment

First, create a new directory for your project and set up a new Node.js project using npm init -y. This will create a package.json file with default settings.

mkdir bcrypt-example
cd bcrypt-example
npm init -y

Step 2: Install Dependencies

Install the bcrypt package which we'll use for hashing passwords:

npm install bcrypt

Step 3: Create a Simple Script to Hash Passwords

Create a JavaScript file named hashPassword.js. This script will hash a given password.

// hashPassword.js

const bcrypt = require('bcrypt');
const saltRounds = 10;

const plainPassword = 'mySuperSecurePassword';

bcrypt.hash(plainPassword, saltRounds, (err, hash) => {
    if (err) {
        console.error('Error during hashing:', err);
        return;
    }
    console.log('Hashed Password:', hash);
});

Explanation:

• saltRounds: This indicates the cost factor in bcrypt; it specifies the number of rounds the key derivation function is processed.
• bcrypt.hash(): This is an asynchronous method that takes three parameters: the plaintext password, the salt rounds, and a callback to handle the result.

Step 4: Run the Hash Password Script

Run the script to see the hashed version of the password:

node hashPassword.js

You should see something like this:

Hashed Password: $2b$10$iJH6YpQFZV17GzN5Y8S1W.9jU6Xwv2J2GqZBfG6Xwv2J2GqZBfG6Xwv2

Note: The actual output will be different each time because the salt is different for each run.

Step 5: Create a Simple Script to Verify Hashed Passwords

Create another JavaScript file named verifyPassword.js. This script will verify a hashed password against a plaintext password.

// verifyPassword.js

const bcrypt = require('bcrypt');

const plainPassword = 'mySuperSecurePassword';

// Use the hash generated from the previous step
const hashedPassword = '$2b$10$iJH6YpQFZV17GzN5Y8S1W.9jU6Xwv2J2GqZBfG6Xwv2J2GqZBfG6Xwv2';

bcrypt.compare(plainPassword, hashedPassword, (err, result) => {
    if (err) {
        console.error('Error during verification:', err);
        return;
    }
    if (result) {
        console.log('Password verified successfully!');
    } else {
        console.log('Invalid password.');
    }
});

Explanation:

• bcrypt.compare(): This is an asynchronous method that checks if the given plaintext password matches the hashed password. It takes three parameters: the plain text password, the hashed password, and a callback that returns whether the passwords match.

Step 6: Run the Verify Password Script

Run the script to verify the password:

node verifyPassword.js

You should see something like this:

Password verified successfully!

If you try to verify with an incorrect password, you'll see:

Invalid password.

Example Using Promises

Since bcrypt provides promise-based methods, let's rewrite the hashing and verifying scripts using promises.

Hash Password with Promise:

// hashPasswordWithPromise.js

const bcrypt = require('bcrypt');
const saltRounds = 10;

const plainPassword = 'mySuperSecurePassword';

async function hashPassword() {
    try {
        const hash = await bcrypt.hash(plainPassword, saltRounds);
        console.log('Hashed Password:', hash);
    } catch (err) {
        console.error('Error during hashing:', err);
    }
}

hashPassword();

Verify Password with Promise:

// verifyPasswordWithPromise.js

const bcrypt = require('bcrypt');

const plainPassword = 'mySuperSecurePassword';

// Use the hash generated from the previous step
const hashedPassword = '$2b$10$iJH6YpQFZV17GzN5Y8S1W.9jU6Xwv2J2GqZBfG6Xwv2J2GqZBfG6Xwv2';

async function verifyPassword() {
    try {
        const result = await bcrypt.compare(plainPassword, hashedPassword);
        if (result) {
            console.log('Password verified successfully!');
        } else {
            console.log('Invalid password.');
        }
    } catch (err) {
        console.error('Error during verification:', err);
    }
}

verifyPassword();

Running the Revised Scripts

Run the revised scripts using Node.js:

node hashPasswordWithPromise.js
node verifyPasswordWithPromise.js

The outputs should be the same as before but now using promise-based async/await syntax.

Summary

In this step-by-step example, you learned how to:

1. Set up a Node.js environment.
2. Install the bcrypt library.
3. Hash a password using bcrypt.hash().
4. Verify a hashed password using bcrypt.compare().
5. Use promise-based calls for hashing and verifying passwords.

This should provide a solid foundation to start using bcrypt in your Node.js applications for secure password storage.