Password hashing with bcrypt in Express - Step-by-Step Execution

Concept Flow - Password hashing with bcrypt

Receive plain password

↓

Generate salt with bcrypt

↓

Hash password + salt

↓

Store hashed password

↓

Later: Receive login password

↓

Compare login password with stored hash

↓

Return match result: true/false

This flow shows how bcrypt creates a salt, hashes a password, stores it, and later compares login attempts securely.

Execution Sample

Express

import bcrypt from 'bcrypt';

const password = 'mySecret123';
const saltRounds = 10;

async function hashPassword() {
  const salt = await bcrypt.genSalt(saltRounds);
  const hashed = await bcrypt.hash(password, salt);
  return hashed;
}

async function checkPassword(hashedPassword, inputPassword) {
  const match = await bcrypt.compare(inputPassword, hashedPassword);
  return match;
}

This code hashes a password with bcrypt and then checks if a login password matches the stored hash.

Execution Table

Step	Action	Input	Output	Notes
1	Receive plain password	mySecret123	mySecret123	User inputs password
2	Generate salt	saltRounds=10	$2b$10$eW5...	Salt created with cost factor 10
3	Hash password + salt	password + salt	$2b$10$eW5...hashedvalue	Password hashed securely
4	Store hashed password	$2b$10$eW5...hashedvalue	Stored in DB	Hash saved, not plain password
5	Receive login password	mySecret123	mySecret123	User tries to login
6	Compare login password with stored hash	mySecret123, $2b$10$eW5...hashedvalue	true	Password matches hash
7	Return match result	true	Allow login	User authenticated successfully

💡 Comparison returns false if passwords don't match, stopping login.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 6
password	undefined	mySecret123	mySecret123	mySecret123	mySecret123
salt	undefined	$2b$10$eW5...	$2b$10$eW5...	$2b$10$eW5...	$2b$10$eW5...
hashed	undefined	undefined	$2b$10$eW5...hashedvalue	$2b$10$eW5...hashedvalue	$2b$10$eW5...hashedvalue
match	undefined	undefined	undefined	undefined	true

Key Moments - 3 Insights

Why do we generate a salt before hashing the password?

The salt adds randomness to the password hash, making it unique even if two users have the same password. See Step 2 in the execution_table where salt is generated before hashing.

Why can't we just store the plain password instead of the hash?

Storing plain passwords is unsafe because if the database leaks, attackers get all passwords. Hashing protects passwords by storing only the hashed version (Step 4).

How does bcrypt verify the password without storing the plain password?

bcrypt compares the login password by hashing it with the stored salt inside the hash and checks if it matches the stored hash (Step 6).

Visual Quiz - 3 Questions

Look at the execution_table, what is the output of Step 3?

A A plain password string

B A salt string

C A hashed password string

D A boolean true/false

💡 Hint

Check the Output column at Step 3 in the execution_table.

At which step does the system decide if the login password matches the stored hash?

A Step 4

B Step 6

C Step 2

D Step 7

💡 Hint

Look for the step where bcrypt.compare is used in the execution_table.

If the saltRounds value is increased, what changes in the execution_table?

A Step 2 output salt will be longer and hashing slower

B Step 3 output will be plain password

C Step 6 match will always be false

D Step 7 will skip login

💡 Hint

Salt generation depends on saltRounds as shown in Step 2.

Concept Snapshot

Password hashing with bcrypt:
- Generate a salt with cost factor (saltRounds)
- Hash password + salt to create secure hash
- Store only the hash, never plain password
- On login, compare input password with stored hash
- bcrypt handles salt internally during compare
- Higher saltRounds means stronger but slower hashing

Full Transcript

This visual trace shows how bcrypt hashes passwords in an Express app. First, the plain password is received. Then bcrypt generates a salt using a cost factor called saltRounds. The password is combined with this salt and hashed securely. The hashed password is stored in the database, never the plain password. Later, when a user logs in, bcrypt compares the entered password with the stored hash by hashing it internally with the salt. If they match, login is allowed. This process protects user passwords by making it very hard for attackers to reverse the hash. Increasing saltRounds makes hashing stronger but slower.