Password hashing with bcrypt in Node.js - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of bcrypt hash comparison

What will be the output of this Node.js code using bcrypt?

Node.js

import bcrypt from 'bcrypt';

async function test() {
  const password = 'mypassword';
  const hash = await bcrypt.hash(password, 10);
  const result = await bcrypt.compare('mypassword', hash);
  console.log(result);
}
test();

A true

B false

C undefined

D Throws an error

💡 Hint

bcrypt.compare returns true if the plain text matches the hash.

bcrypt.compare checks if the plain password matches the hashed password and returns true or false accordingly.

📝 Syntax

intermediate

Identify the syntax error in bcrypt usage

Which option contains a syntax error when hashing a password with bcrypt?

A const hash = await bcrypt.hash(password, 10);

B const hash = await bcrypt.hash(password, '10');

C const hash = bcrypt.hash(password, 10);

D const hash = await bcrypt.hash(password 10);

💡 Hint

Check for missing commas and correct argument types.

Option D is missing a comma between arguments, causing a syntax error.

❓ component_behavior

advanced

Behavior of bcrypt.hash with different salt rounds

What happens if you increase the salt rounds parameter in bcrypt.hash from 10 to 15?

A Hashing fails with an error

B Hashing becomes faster but less secure

C Hashing becomes slower but more secure

D Hashing speed and security remain the same

💡 Hint

Salt rounds control the computational cost of hashing.

Higher salt rounds increase the time to hash, making it harder to brute force, thus more secure but slower.

🔧 Debug

advanced

Why does bcrypt.compare always return false?

Given this code snippet, why does bcrypt.compare always return false? const hash = bcrypt.hashSync('secret', 10); const result = await bcrypt.compare('secret', hash + 'extra'); console.log(result);

Node.js

const hash = bcrypt.hashSync('secret', 10);
const result = await bcrypt.compare('secret', hash + 'extra');
console.log(result);

A bcrypt.compare requires a callback, not await

B The hash string was modified, so it no longer matches

C The password 'secret' is incorrect

D bcrypt.compare cannot handle synchronous hashes

💡 Hint

Check if the hash string is exactly the same as generated.

Appending 'extra' to the hash changes it, so compare returns false.

🧠 Conceptual

expert

Why use bcrypt over simple hashing functions?

Why is bcrypt preferred for password hashing instead of simple hash functions like SHA-256?

A bcrypt is designed to be slow and includes salt to prevent rainbow table attacks

B bcrypt produces shorter hashes than SHA-256

C bcrypt hashes can be reversed to get the original password

D bcrypt is faster and uses less memory than SHA-256

💡 Hint

Think about security features specific to password hashing.

bcrypt is slow and uses salt, making it resistant to brute force and rainbow table attacks, unlike fast hashes like SHA-256.