Password hashing with bcrypt in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of using bcrypt in password handling?

Bcrypt is used to securely hash passwords so that the original password cannot be easily recovered, protecting user data even if the database is compromised.

beginner

Which bcrypt function is used to create a hashed password from a plain text password?

The function bcrypt.hash() is used to generate a hashed password from a plain text password.

intermediate

What does the 'salt' do in bcrypt password hashing?

A salt is random data added to the password before hashing to ensure that even identical passwords have different hashes, making attacks like rainbow tables ineffective.

beginner

How do you verify a user's password using bcrypt in Express?

Use bcrypt.compare(plainPassword, hashedPassword) to check if the plain password matches the stored hashed password. It returns true if they match.

intermediate

Why should you avoid using a fixed salt or no salt when hashing passwords?

Without a unique salt for each password, attackers can use precomputed tables to reverse hashes or find users with the same password, reducing security.

Which bcrypt method is used to create a hashed password?

A bcrypt.genSalt()

B bcrypt.compare()

C bcrypt.hash()

D bcrypt.encrypt()

bcrypt.hash() creates a hashed password from plain text.

What is the role of a salt in bcrypt hashing?

A To speed up hashing

B To add randomness to the hash

C To store the password

D To decrypt the password

A salt adds randomness so identical passwords have different hashes.

How do you check if a password matches a bcrypt hash?

A bcrypt.hash()

B bcrypt.check()

C bcrypt.verify()

D bcrypt.compare()

bcrypt.compare() compares a plain password with a hashed one.

Why is bcrypt preferred over simple hashing functions for passwords?

A It is designed to be slow and includes salt

B It uses a fixed salt

C It is faster

D It stores passwords in plain text

Bcrypt is slow and uses salt to protect against attacks.

What happens if you reuse the same salt for all passwords?

A Attackers can find matching hashes more easily

B Passwords become more secure

C It has no effect

D It speeds up login

Reusing salt makes it easier for attackers to find users with the same password.

Explain how bcrypt helps protect user passwords in an Express app.

Think about what happens when someone tries to steal your password database.

Describe the steps to hash and verify a password using bcrypt in Express.

Focus on what happens when a user signs up and then logs in.