Password hashing with bcrypt in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of bcrypt hash comparison

What will be the output of this Node.js code using bcrypt?

Node.js

import bcrypt from 'bcrypt';

async function test() {
  const password = 'mypassword';
  const hash = await bcrypt.hash(password, 10);
  const result = await bcrypt.compare('mypassword', hash);
  console.log(result);
}
test();

A true

B false

C undefined

D Throws an error

💡 Hint

bcrypt.compare returns true if the plain text matches the hash.

bcrypt.compare checks if the plain password matches the hashed password and returns true or false accordingly.

📝 Syntax

intermediate

Identify the syntax error in bcrypt usage

Which option contains a syntax error when hashing a password with bcrypt?

A const hash = await bcrypt.hash(password, 10);

B const hash = await bcrypt.hash(password, '10');

C const hash = bcrypt.hash(password, 10);

D const hash = await bcrypt.hash(password 10);

💡 Hint

Check for missing commas and correct argument types.

Option D is missing a comma between arguments, causing a syntax error.

❓ component_behavior

advanced

Behavior of bcrypt.hash with different salt rounds

What happens if you increase the salt rounds parameter in bcrypt.hash from 10 to 15?

A Hashing fails with an error

B Hashing becomes faster but less secure

C Hashing becomes slower but more secure

D Hashing speed and security remain the same

💡 Hint

Salt rounds control the computational cost of hashing.

Higher salt rounds increase the time to hash, making it harder to brute force, thus more secure but slower.

🔧 Debug

advanced

Why does bcrypt.compare always return false?

Given this code snippet, why does bcrypt.compare always return false? const hash = bcrypt.hashSync('secret', 10); const result = await bcrypt.compare('secret', hash + 'extra'); console.log(result);

Node.js

const hash = bcrypt.hashSync('secret', 10);
const result = await bcrypt.compare('secret', hash + 'extra');
console.log(result);

A bcrypt.compare requires a callback, not await

B The hash string was modified, so it no longer matches

C The password 'secret' is incorrect

D bcrypt.compare cannot handle synchronous hashes

💡 Hint

Check if the hash string is exactly the same as generated.

Appending 'extra' to the hash changes it, so compare returns false.

🧠 Conceptual

expert

Why use bcrypt over simple hashing functions?

Why is bcrypt preferred for password hashing instead of simple hash functions like SHA-256?

A bcrypt is designed to be slow and includes salt to prevent rainbow table attacks

B bcrypt produces shorter hashes than SHA-256

C bcrypt hashes can be reversed to get the original password

D bcrypt is faster and uses less memory than SHA-256

💡 Hint

Think about security features specific to password hashing.

bcrypt is slow and uses salt, making it resistant to brute force and rainbow table attacks, unlike fast hashes like SHA-256.

Practice

1. What is the main purpose of using bcrypt in a Node.js application?

easy

A. To securely hash user passwords before storing them

B. To encrypt user data for faster retrieval

C. To compress files on the server

D. To generate random user IDs

Solution

1. Step 1: Understand bcrypt's role

   Bcrypt is designed to hash passwords securely, making them hard to reverse.

2. Step 2: Identify the correct purpose

   Encrypting data or compressing files are not bcrypt's functions; it focuses on password hashing.

3. Final Answer:

   To securely hash user passwords before storing them -> Option A

4. Quick Check:

   Password hashing = Secure storage [OK]

Hint: Bcrypt is for password security, not encryption or compression [OK]

Common Mistakes:

• Confusing hashing with encryption
• Thinking bcrypt compresses data
• Assuming bcrypt generates IDs

2. Which of the following is the correct way to hash a password asynchronously using bcrypt in Node.js?

easy

A. const hashed = await bcrypt.hash(password, 10);

B. const hashed = bcrypt.hashSync(password, 10);

C. const hashed = bcrypt.compare(password, 10);

D. const hashed = bcrypt.hash(password);

Solution

1. Step 1: Identify asynchronous hashing syntax

   Bcrypt's async hash function requires await and two arguments: password and salt rounds.

2. Step 2: Check each option

   hashSync uses the synchronous method, compare is for verification not hashing, and the hash call misses salt rounds.

3. Final Answer:

   const hashed = await bcrypt.hash(password, 10); -> Option A

4. Quick Check:

   Async hash needs await and salt rounds [OK]

Hint: Async bcrypt hash needs await and salt rounds [OK]

Common Mistakes:

• Using hashSync instead of async hash
• Calling compare instead of hash
• Omitting salt rounds argument

3. What will the following code output if the password matches the hash?

const bcrypt = require('bcrypt');

async function check() {
  const password = 'secret123';
  const hash = await bcrypt.hash(password, 10);
  const result = await bcrypt.compare('secret123', hash);
  console.log(result);
}
check();

medium

A. false

B. true

C. undefined

D. Error

Solution

1. Step 1: Understand bcrypt.compare behavior

   It returns true if the plain password matches the hashed password.

2. Step 2: Analyze the code flow

   The password 'secret123' is hashed and then compared with the same password, so result is true.

3. Final Answer:

   true -> Option B

4. Quick Check:

   Matching password returns true [OK]

Hint: Compare returns true if passwords match [OK]

Common Mistakes:

• Expecting false for matching passwords
• Confusing compare with hash
• Ignoring async/await in code

4. Identify the error in this bcrypt usage:

const bcrypt = require('bcrypt');

async function verify() {
  const password = 'mypassword';
  const hash = bcrypt.hash(password, 10);
  const match = await bcrypt.compare(password, hash);
  console.log(match);
}
verify();

medium

A. Incorrect salt rounds value

B. Using compare instead of hash to create hash

C. Password variable is not defined

D. Missing await before bcrypt.hash causing hash to be a Promise

Solution

1. Step 1: Check bcrypt.hash usage

   Bcrypt.hash is async and returns a Promise, so it needs await to get the hashed string.

2. Step 2: Identify the error impact

   Without await, hash is a Promise, causing compare to fail or behave unexpectedly.

3. Final Answer:

   Missing await before bcrypt.hash causing hash to be a Promise -> Option D

4. Quick Check:

   Async hash needs await [OK]

Hint: Always await async bcrypt.hash calls [OK]

Common Mistakes:

• Forgetting await on async functions
• Confusing compare with hash
• Using invalid salt rounds

5. You want to securely store user passwords and verify them later. Which approach correctly combines hashing and verification using bcrypt in an async function?

hard

A. Hash password synchronously with bcrypt.hashSync(password, 12) and verify asynchronously with await bcrypt.compare(input, storedHash)

B. Store the plain password and verify by hashing input with bcrypt.hashSync(input, 12) and comparing strings

C. Hash the password with await bcrypt.hash(password, 12) and verify with await bcrypt.compare(input, storedHash)

D. Encrypt password with bcrypt.encrypt(password) and decrypt for verification

Solution

1. Step 1: Choose secure async hashing and verification

   Using async bcrypt.hash with salt rounds (12) and async bcrypt.compare is best practice.

2. Step 2: Evaluate other options

   Storing plain passwords and hashing input for string comparison is insecure, mixing sync hashing with async verification is inconsistent, and bcrypt has no encrypt/decrypt methods.

3. Final Answer:

   Hash the password with await bcrypt.hash(password, 12) and verify with await bcrypt.compare(input, storedHash) -> Option C

4. Quick Check:

   Async hash and compare with salt rounds = secure [OK]

Hint: Use async hash and compare with salt rounds for security [OK]

Common Mistakes:

• Storing plain passwords
• Mixing sync and async bcrypt calls
• Assuming bcrypt can encrypt/decrypt