Password hashing with bcrypt in Node.js - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of using bcrypt for password hashing?

Bcrypt securely hashes passwords to protect them from being easily read or reversed if stolen. It adds a salt and uses multiple rounds to slow down attackers.

beginner

What does the 'salt' do in bcrypt hashing?

A salt is random data added to the password before hashing. It ensures that even identical passwords have different hashes, preventing attackers from using precomputed tables.

beginner

How do you verify a password using bcrypt in Node.js?

You use bcrypt's compare function to check if the plain password matches the stored hashed password. It returns true if they match, false otherwise.

intermediate

What is the significance of the 'salt rounds' parameter in bcrypt?

Salt rounds control how many times the hashing process runs. More rounds mean stronger security but slower hashing. A common value is 10.

beginner

Show a simple example of hashing a password with bcrypt in Node.js.

```js
import bcrypt from 'bcrypt';

async function hashPassword() {
  const password = 'mySecret123';
  const saltRounds = 10;
  const hash = await bcrypt.hash(password, saltRounds);
  console.log(hash);
}

hashPassword();
``` This code creates a hashed password asynchronously.

What does bcrypt add to a password before hashing to make it more secure?

A A suffix

B A prefix

C A checksum

D A salt

Bcrypt adds a random salt to the password before hashing to ensure unique hashes.

Which bcrypt function checks if a password matches a stored hash?

A bcrypt.hash()

B bcrypt.compare()

C bcrypt.verify()

D bcrypt.check()

bcrypt.compare() compares a plain password with a hashed password.

What happens if you increase the salt rounds in bcrypt?

A Hashing becomes slower

B Hashing becomes faster

C Hashing output becomes shorter

D Hashing output becomes predictable

More salt rounds mean more hashing cycles, making hashing slower but more secure.

Why should you never store plain passwords in your database?

A They are hard to read

B They take more space

C They can be easily stolen and misused

D They slow down the app

Storing plain passwords risks user security if the database is breached.

Which of these is a valid bcrypt salt rounds value commonly used?

A 10

B 1

C 5

D 100

10 is a common default for salt rounds balancing security and performance.

Explain how bcrypt protects passwords and why it is better than simple hashing.

Think about what makes bcrypt hashes different and harder to crack.

Describe the steps to hash and verify a password using bcrypt in Node.js.

Consider both creating the hash and checking it later.