Password hashing with bcrypt in Express - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

What is the output of this bcrypt hash comparison?

Given the following Express code snippet using bcrypt, what will be the output logged to the console?

Express

import bcrypt from 'bcrypt';

const password = 'mypassword';
const hash = await bcrypt.hash(password, 10);
const result = await bcrypt.compare('mypassword', hash);
console.log(result);

A undefined

B false

C true

D Throws an error

💡 Hint

bcrypt.compare returns true if the plain text matches the hashed password.

bcrypt.compare checks if the plain password matches the hashed one and returns true if they match.

❓ component_behavior

intermediate

What happens if you use a wrong password in bcrypt.compare?

In an Express app, if you hash a password and then compare a different password using bcrypt.compare, what will be the result?

Express

const hash = await bcrypt.hash('correctpassword', 10);
const result = await bcrypt.compare('wrongpassword', hash);
console.log(result);

A false

B Throws a TypeError

C true

D undefined

💡 Hint

bcrypt.compare returns false if passwords do not match.

bcrypt.compare returns false when the plain password does not match the stored hash.

📝 Syntax

advanced

Which option correctly hashes a password with bcrypt in Express?

Choose the correct code snippet that hashes a password string using bcrypt with 12 salt rounds.

A const hash = bcrypt.hash('pass123', 12);

B const hash = await bcrypt.hash('pass123', 12);

C const hash = bcrypt.hashSync('pass123', 12);

D const hash = bcrypt.hash('pass123', '12');

💡 Hint

bcrypt.hash returns a promise and needs await or then.

bcrypt.hash is async and returns a promise, so you must await it or use then. Option B correctly awaits the promise.

🔧 Debug

advanced

Why does this bcrypt hash code throw an error?

Identify the cause of the error in this Express code snippet:

Express

import bcrypt from 'bcrypt';

const password = 'secret';
const hash = bcrypt.hash(password, 10);
console.log(hash);

A bcrypt.hash returns a promise and must be awaited or handled with then()

B bcrypt.hash requires a callback function as the third argument

C The salt rounds must be a string, not a number

D bcrypt.hash cannot hash strings shorter than 8 characters

💡 Hint

Check if the code handles the asynchronous nature of bcrypt.hash.

bcrypt.hash returns a promise. Without await or then(), the variable hash is a promise object, not the hashed string.

🧠 Conceptual

expert

Why is it important to use salt rounds in bcrypt hashing?

Select the best explanation for why bcrypt uses salt rounds when hashing passwords.

A Salt rounds are used to encrypt the password instead of hashing it

B Salt rounds reduce the size of the hashed password for storage efficiency

C Salt rounds allow bcrypt to generate multiple hashes for the same password instantly

D Salt rounds increase the time needed to hash, making brute-force attacks slower

💡 Hint

Think about how salt rounds affect security and attack difficulty.

Salt rounds increase the computational work needed to hash passwords, slowing down attackers trying many guesses.

Practice

1. What is the main purpose of using bcrypt in an Express app?

easy

A. To securely hash user passwords before saving them

B. To speed up server response time

C. To format JSON data

D. To manage user sessions

Solution

1. Step 1: Understand bcrypt's role

   Bcrypt is a library designed to hash passwords securely, making them hard to read if stolen.

2. Step 2: Identify the correct purpose in Express

   In Express apps, bcrypt is used to hash passwords before storing them in a database to protect user data.

3. Final Answer:

   To securely hash user passwords before saving them -> Option A

4. Quick Check:

   Password hashing = Secure storage [OK]

Hint: Bcrypt is for password security, not speed or formatting [OK]

Common Mistakes:

• Thinking bcrypt speeds up server
• Confusing bcrypt with session management
• Using bcrypt for data formatting

2. Which of the following is the correct way to hash a password asynchronously using bcrypt in Express?

easy

A. const hashed = bcrypt.hashSync(password, 10);

B. const hashed = bcrypt.hash(password);

C. const hashed = await bcrypt.hash(password, 10);

D. const hashed = bcrypt.compare(password, 10);

Solution

1. Step 1: Identify asynchronous bcrypt hashing syntax

   Bcrypt's async hash function requires await and two arguments: the password and salt rounds.

2. Step 2: Check each option

   const hashed = await bcrypt.hash(password, 10); uses await bcrypt.hash(password, 10); which is correct async usage. const hashed = bcrypt.hashSync(password, 10); is synchronous, C is wrong function, B misses salt rounds.

3. Final Answer:

   const hashed = await bcrypt.hash(password, 10); -> Option C

4. Quick Check:

   Async hash needs await and salt rounds [OK]

Hint: Async bcrypt hash always uses await and salt rounds [OK]

Common Mistakes:

• Using synchronous hashSync instead of async
• Calling compare instead of hash
• Omitting salt rounds argument

3. What will be the output of this code snippet?

const bcrypt = require('bcrypt');
async function test() {
  const password = 'secret123';
  const hash = await bcrypt.hash(password, 5);
  const match = await bcrypt.compare('secret123', hash);
  console.log(match);
}
test();

medium

A. Error

B. false

C. undefined

D. true

Solution

1. Step 1: Understand bcrypt.hash and bcrypt.compare

   The code hashes 'secret123' with salt rounds 5, then compares the original password to the hash.

2. Step 2: Analyze the compare result

   Since the password matches the hash, bcrypt.compare returns true, which is logged.

3. Final Answer:

   true -> Option D

4. Quick Check:

   Password matches hash = true [OK]

Hint: Compare returns true if password matches hash [OK]

Common Mistakes:

• Expecting false because of low salt rounds
• Thinking compare returns the hash
• Missing await causing undefined

4. Identify the error in this Express route using bcrypt:

app.post('/signup', async (req, res) => {
  const { password } = req.body;
  const hashed = bcrypt.hash(password, 10);
  // Save hashed password to DB
  res.send('User created');
});

medium

A. bcrypt.hash requires 3 arguments, only 2 given

B. Missing await before bcrypt.hash causing a Promise instead of hash

C. bcrypt.hashSync should be used instead of bcrypt.hash

D. Password should not be hashed before saving

Solution

1. Step 1: Check bcrypt.hash usage

   Bcrypt.hash is async and returns a Promise, so it needs await to get the hashed string.

2. Step 2: Identify missing await effect

   Without await, hashed is a Promise, not the actual hash, causing errors when saving.

3. Final Answer:

   Missing await before bcrypt.hash causing a Promise instead of hash -> Option B

4. Quick Check:

   Async bcrypt.hash needs await [OK]

Hint: Always await async bcrypt.hash to get the hash string [OK]

Common Mistakes:

• Forgetting await on async bcrypt.hash
• Using wrong number of arguments
• Thinking hashSync is mandatory

5. You want to create a secure signup route in Express that hashes the password and then verifies it immediately to confirm hashing worked. Which code snippet correctly does this?

hard

A. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

B. app.post('/signup', (req, res) => {
const { password } = req.body;
const hash = bcrypt.hashSync(password, 12);
const valid = bcrypt.compareSync(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

C. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = bcrypt.hash(password, 12);
const valid = bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

D. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = await bcrypt.hash(password);
const valid = await bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

Solution

1. Step 1: Check async usage and salt rounds

   app.post('/signup', async (req, res) => { const { password } = req.body; const hash = await bcrypt.hash(password, 12); const valid = await bcrypt.compare(password, hash); if (valid) res.send('Signup successful'); else res.status(500).send('Hashing error'); }); uses async/await correctly and provides salt rounds (12) to bcrypt.hash, which is best practice.

2. Step 2: Verify immediate password check

   It compares the original password with the hash using await bcrypt.compare, then sends success if valid.

3. Step 3: Analyze other options

   app.post('/signup', (req, res) => { const { password } = req.body; const hash = bcrypt.hashSync(password, 12); const valid = bcrypt.compareSync(password, hash); if (valid) res.send('Signup successful'); else res.status(500).send('Hashing error'); }); uses sync methods which block the server, C misses await causing Promises, D misses salt rounds in hash.

4. Final Answer:

   Option A code snippet with async/await and salt rounds -> Option A

5. Quick Check:

   Async hash with salt rounds + compare = correct [OK]

Hint: Use async/await with salt rounds and compare for secure signup [OK]

Common Mistakes:

• Using synchronous bcrypt methods in async routes
• Forgetting await causing Promises
• Omitting salt rounds in hash