Introduction
Passwords are the first line of defense in most applications. If they are stored incorrectly, even a small data breach can expose thousands—or millions—of user accounts. This is why storing passwords securely is not just a best practice, it is a fundamental requirement for any backend system.
A common mistake developers make is storing passwords as plain text or using simple hashing methods. In real-world scenarios, this can lead to serious security issues. Instead, we use a technique called hashing with Bcrypt, which is specifically designed to store passwords safely.
In this article, we’ll understand how password security works, why Bcrypt is widely used, and how to implement it properly in backend applications.
Why Storing Passwords in Plain Text is Dangerous
Let’s start with a simple example.
If your database stores passwords like this:
user1 → password123
user2 → admin@123
If a hacker gains access to your database, all passwords are immediately exposed. Users who reuse passwords across platforms are especially at risk.
Even hashing with basic algorithms like MD5 or SHA256 is not enough anymore, because attackers can use precomputed tables (rainbow tables) or brute-force attacks to crack them quickly.
This is where Bcrypt comes in.
What is Bcrypt?
Bcrypt is a password hashing algorithm designed specifically for security.
Unlike simple hashing algorithms, Bcrypt:
Adds a random salt to each password
Is intentionally slow (making brute-force attacks difficult)
Automatically handles salting and hashing together
In simple terms, even if two users have the same password, their stored hashes will be different.
How Bcrypt Works
When you store a password using Bcrypt:
A random salt is generated
The password is combined with the salt
The result is hashed multiple times
The final hash is stored in the database
When a user logs in:
The entered password is hashed again
Compared with the stored hash
At no point is the original password stored or retrievable.
Installing Bcrypt in Node.js
npm install bcrypt
Hashing Passwords Before Storing
Here’s how you securely store a password:
import bcrypt from 'bcrypt';
const saltRounds = 10;
async function hashPassword(password) {
const hashedPassword = await bcrypt.hash(password, saltRounds);
return hashedPassword;
}
What this does:
Generates a salt internally
Hashes the password
Returns a secure hash
Storing Password During User Registration
const registerUser = async (req, res) => {
const { email, password } = req.body;
const hashedPassword = await bcrypt.hash(password, 10);
// Save to database
await User.create({ email, password: hashedPassword });
res.send("User registered successfully");
};
In real applications:
You never store the plain password
Only the hashed version is saved
Comparing Passwords During Login
When a user logs in, you compare the entered password with the stored hash.
const loginUser = async (req, res) => {
const { email, password } = req.body;
const user = await User.findOne({ email });
if (!user) {
return res.status(404).send("User not found");
}
const isMatch = await bcrypt.compare(password, user.password);
if (!isMatch) {
return res.status(401).send("Invalid credentials");
}
res.send("Login successful");
};
Join the conversation! Your thoughts help the community grow.