Password hashing with bcrypt in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this bcrypt hash comparison?

Given the following Express code snippet using bcrypt, what will be the output logged to the console?

Express

import bcrypt from 'bcrypt';

const password = 'mypassword';
const hash = await bcrypt.hash(password, 10);
const result = await bcrypt.compare('mypassword', hash);
console.log(result);

A undefined

B false

C true

D Throws an error

💡 Hint

bcrypt.compare returns true if the plain text matches the hashed password.

bcrypt.compare checks if the plain password matches the hashed one and returns true if they match.

❓ component_behavior

intermediate

What happens if you use a wrong password in bcrypt.compare?

In an Express app, if you hash a password and then compare a different password using bcrypt.compare, what will be the result?

Express

const hash = await bcrypt.hash('correctpassword', 10);
const result = await bcrypt.compare('wrongpassword', hash);
console.log(result);

A false

B Throws a TypeError

C true

D undefined

💡 Hint

bcrypt.compare returns false if passwords do not match.

bcrypt.compare returns false when the plain password does not match the stored hash.

📝 Syntax

advanced

Which option correctly hashes a password with bcrypt in Express?

Choose the correct code snippet that hashes a password string using bcrypt with 12 salt rounds.

A const hash = bcrypt.hash('pass123', 12);

B const hash = await bcrypt.hash('pass123', 12);

C const hash = bcrypt.hashSync('pass123', 12);

D const hash = bcrypt.hash('pass123', '12');

💡 Hint

bcrypt.hash returns a promise and needs await or then.

bcrypt.hash is async and returns a promise, so you must await it or use then. Option B correctly awaits the promise.

🔧 Debug

advanced

Why does this bcrypt hash code throw an error?

Identify the cause of the error in this Express code snippet:

Express

import bcrypt from 'bcrypt';

const password = 'secret';
const hash = bcrypt.hash(password, 10);
console.log(hash);

A bcrypt.hash returns a promise and must be awaited or handled with then()

B bcrypt.hash requires a callback function as the third argument

C The salt rounds must be a string, not a number

D bcrypt.hash cannot hash strings shorter than 8 characters

💡 Hint

Check if the code handles the asynchronous nature of bcrypt.hash.

bcrypt.hash returns a promise. Without await or then(), the variable hash is a promise object, not the hashed string.

🧠 Conceptual

expert

Why is it important to use salt rounds in bcrypt hashing?

Select the best explanation for why bcrypt uses salt rounds when hashing passwords.

A Salt rounds are used to encrypt the password instead of hashing it

B Salt rounds reduce the size of the hashed password for storage efficiency

C Salt rounds allow bcrypt to generate multiple hashes for the same password instantly

D Salt rounds increase the time needed to hash, making brute-force attacks slower

💡 Hint

Think about how salt rounds affect security and attack difficulty.

Salt rounds increase the computational work needed to hash passwords, slowing down attackers trying many guesses.