bcrypt In NodeJS

In this blog, we will see the simple implementation of bcrypt in Node js applications, along with advantages & disadvantages of bcrypt.

bcrypt Problem

How we can implement a solution to secure the user's login credentials in Node.js?

Solution

The solution to this problem is "bcrypt".

1. bcrypt is a hashing technique based on "Blowfish block cipher cryptomatic algorithm"
2. It is an adaptive function designed by Niels Provos and David Mazières in 1999
3. It has implementation in C, C++, C#, Go, Java, JavaScript, Elixir, Perl, PHP, Python, Ruby and other languages.

Why one should choose bcrypt over other hashing algorithms?

1. Decryption of password hashed with bcrypt is next to impossible.
2. One time hashing while signing up
3. Key factor is the number of rounds for salting
4. Adjust the cost of hashing
5. Increasing the number of rounds makes the password more resistant to hacks

How to implement it?

1. Install the following module in your app.
   

   npm install --save bcrypt
   const bcrypt = require('bcrypt');

2. Encrypt password and store into database.
   

   bcrypt.hash('myPassword', 10, function(err, hash) {
      // Store hash in database
   });

3. Retrieve the hashed password from the database and compare with the user entered password.
   

   bcrypt.compare('somePassword', hash, function(err, res) {
       if (res) {
           // Passwords match
       } else {
           // Passwords don't match
       }
   });

4. Example -
   

   const bcrypt = require('bcrypt');
   var mypassword = 'pass';
   console.log(bcrypt.hashSync(mypassword, 10));
   var hash1 = bcrypt.hashSync(mypassword, 10)
   if (bcrypt.compareSync(mypassword, hash1)) {
       console.log('Password matched!');
   } else {
       console.log('Password doesn\'t match');
   }
   if (bcrypt.compareSync(bcrypt.hashSync(mypassword, 10), hash1)) {
       console.log('Password matched!');
   } else {
       console.log('Password doesn\'t match');
   }

Pros

1. Protect against rainbow table attacks
2. Resistant to brute-force search attacks

Cons

1. Due to salting, it makes the algorithm slower
2. Maximum password length ranges from 50 to 72 bytes

Reference

1. https://www.abeautifulsite.net/hashing-passwords-with-nodejs-and-bcrypt
2. https://www.npmjs.com/package/bcrypt
3. https://en.wikipedia.org/wiki/Bcrypt