Password hashing with bcrypt in Express - Performance & Optimization

Performance: Password hashing with bcrypt

MEDIUM IMPACT

This affects server response time during user authentication and registration by adding CPU work for hashing passwords.

Hashing user passwords securely during signup

Express

const bcrypt = require('bcrypt');

app.post('/signup', async (req, res) => {
  const password = req.body.password;
  const hashed = await bcrypt.hash(password, 12); // recommended salt rounds
  // save hashed password
  res.send('User created');
});

Higher salt rounds increase CPU time to hash, slowing attackers but adding moderate server delay.

📈 Performance Gainbalanced CPU cost with strong security, acceptable response time

Hashing user passwords securely during signup

Express

const bcrypt = require('bcrypt');

app.post('/signup', async (req, res) => {
  const password = req.body.password;
  const hashed = await bcrypt.hash(password, 4); // low salt rounds
  // save hashed password
  res.send('User created');
});

Using too few salt rounds makes hashing fast but weakens security, allowing faster brute force attacks.

📉 Performance Costfast hashing, low CPU cost but poor security

Performance Comparison

Pattern	CPU Load	Blocking Behavior	Response Delay	Verdict
bcrypt with low salt rounds	Low CPU	Non-blocking (async)	Fast response	[X] Bad
bcrypt with recommended salt rounds	Medium CPU	Non-blocking (async)	Moderate delay	[OK] Good
bcrypt with recommended salt rounds (sync)	Medium CPU	Blocking	High delay	[X] Bad
No hashing or weak hashing	Minimal CPU	Non-blocking	Fast but insecure	[X] Bad

Rendering Pipeline

Password hashing with bcrypt runs on the server CPU and does not affect browser rendering pipeline directly. However, slow hashing increases server response time, delaying content delivery and affecting perceived page load.

→Server Processing

→Network Response

⚠️ BottleneckCPU-intensive hashing delays server response, increasing time to first byte (TTFB).

Optimization Tips

1Use async bcrypt methods to avoid blocking the server event loop.

2Choose salt rounds that balance security and acceptable server response time.

3Monitor server response times to detect hashing-related delays.

Performance Quiz - 3 Questions

What is the main performance impact of using bcrypt with high salt rounds on a server?

A Increases CPU load and response time during password hashing

B Blocks browser rendering causing layout shifts

C Increases client-side JavaScript bundle size

D Causes network latency due to large hashed passwords

DevTools: Network and Performance panels

How to check: Use Network panel to measure server response time (TTFB). Use Performance panel to record server response delays during login/signup requests.

What to look for: Look for increased TTFB or long server processing times indicating slow password hashing blocking response.

Practice

1. What is the main purpose of using bcrypt in an Express app?

easy

A. To securely hash user passwords before saving them

B. To speed up server response time

C. To format JSON data

D. To manage user sessions

Solution

1. Step 1: Understand bcrypt's role

   Bcrypt is a library designed to hash passwords securely, making them hard to read if stolen.

2. Step 2: Identify the correct purpose in Express

   In Express apps, bcrypt is used to hash passwords before storing them in a database to protect user data.

3. Final Answer:

   To securely hash user passwords before saving them -> Option A

4. Quick Check:

   Password hashing = Secure storage [OK]

Hint: Bcrypt is for password security, not speed or formatting [OK]

Common Mistakes:

• Thinking bcrypt speeds up server
• Confusing bcrypt with session management
• Using bcrypt for data formatting

2. Which of the following is the correct way to hash a password asynchronously using bcrypt in Express?

easy

A. const hashed = bcrypt.hashSync(password, 10);

B. const hashed = bcrypt.hash(password);

C. const hashed = await bcrypt.hash(password, 10);

D. const hashed = bcrypt.compare(password, 10);

Solution

1. Step 1: Identify asynchronous bcrypt hashing syntax

   Bcrypt's async hash function requires await and two arguments: the password and salt rounds.

2. Step 2: Check each option

   const hashed = await bcrypt.hash(password, 10); uses await bcrypt.hash(password, 10); which is correct async usage. const hashed = bcrypt.hashSync(password, 10); is synchronous, C is wrong function, B misses salt rounds.

3. Final Answer:

   const hashed = await bcrypt.hash(password, 10); -> Option C

4. Quick Check:

   Async hash needs await and salt rounds [OK]

Hint: Async bcrypt hash always uses await and salt rounds [OK]

Common Mistakes:

• Using synchronous hashSync instead of async
• Calling compare instead of hash
• Omitting salt rounds argument

3. What will be the output of this code snippet?

const bcrypt = require('bcrypt');
async function test() {
  const password = 'secret123';
  const hash = await bcrypt.hash(password, 5);
  const match = await bcrypt.compare('secret123', hash);
  console.log(match);
}
test();

medium

A. Error

B. false

C. undefined

D. true

Solution

1. Step 1: Understand bcrypt.hash and bcrypt.compare

   The code hashes 'secret123' with salt rounds 5, then compares the original password to the hash.

2. Step 2: Analyze the compare result

   Since the password matches the hash, bcrypt.compare returns true, which is logged.

3. Final Answer:

   true -> Option D

4. Quick Check:

   Password matches hash = true [OK]

Hint: Compare returns true if password matches hash [OK]

Common Mistakes:

• Expecting false because of low salt rounds
• Thinking compare returns the hash
• Missing await causing undefined

4. Identify the error in this Express route using bcrypt:

app.post('/signup', async (req, res) => {
  const { password } = req.body;
  const hashed = bcrypt.hash(password, 10);
  // Save hashed password to DB
  res.send('User created');
});

medium

A. bcrypt.hash requires 3 arguments, only 2 given

B. Missing await before bcrypt.hash causing a Promise instead of hash

C. bcrypt.hashSync should be used instead of bcrypt.hash

D. Password should not be hashed before saving

Solution

1. Step 1: Check bcrypt.hash usage

   Bcrypt.hash is async and returns a Promise, so it needs await to get the hashed string.

2. Step 2: Identify missing await effect

   Without await, hashed is a Promise, not the actual hash, causing errors when saving.

3. Final Answer:

   Missing await before bcrypt.hash causing a Promise instead of hash -> Option B

4. Quick Check:

   Async bcrypt.hash needs await [OK]

Hint: Always await async bcrypt.hash to get the hash string [OK]

Common Mistakes:

• Forgetting await on async bcrypt.hash
• Using wrong number of arguments
• Thinking hashSync is mandatory

5. You want to create a secure signup route in Express that hashes the password and then verifies it immediately to confirm hashing worked. Which code snippet correctly does this?

hard

A. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = await bcrypt.hash(password, 12);
const valid = await bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

B. app.post('/signup', (req, res) => {
const { password } = req.body;
const hash = bcrypt.hashSync(password, 12);
const valid = bcrypt.compareSync(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

C. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = bcrypt.hash(password, 12);
const valid = bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

D. app.post('/signup', async (req, res) => {
const { password } = req.body;
const hash = await bcrypt.hash(password);
const valid = await bcrypt.compare(password, hash);
if (valid) res.send('Signup successful');
else res.status(500).send('Hashing error');
});

Solution

1. Step 1: Check async usage and salt rounds

   app.post('/signup', async (req, res) => { const { password } = req.body; const hash = await bcrypt.hash(password, 12); const valid = await bcrypt.compare(password, hash); if (valid) res.send('Signup successful'); else res.status(500).send('Hashing error'); }); uses async/await correctly and provides salt rounds (12) to bcrypt.hash, which is best practice.

2. Step 2: Verify immediate password check

   It compares the original password with the hash using await bcrypt.compare, then sends success if valid.

3. Step 3: Analyze other options

   app.post('/signup', (req, res) => { const { password } = req.body; const hash = bcrypt.hashSync(password, 12); const valid = bcrypt.compareSync(password, hash); if (valid) res.send('Signup successful'); else res.status(500).send('Hashing error'); }); uses sync methods which block the server, C misses await causing Promises, D misses salt rounds in hash.

4. Final Answer:

   Option A code snippet with async/await and salt rounds -> Option A

5. Quick Check:

   Async hash with salt rounds + compare = correct [OK]

Hint: Use async/await with salt rounds and compare for secure signup [OK]

Common Mistakes:

• Using synchronous bcrypt methods in async routes
• Forgetting await causing Promises
• Omitting salt rounds in hash