Hashing and salting passwords

Model answer. If the database leaks, plain-text passwords are instantly usable everywhere the user reused them. Encryption is reversible: whoever steals the key gets every password. A hash is one-way: you store hash(password) and, at login, hash the attempt and compare.

General-purpose hashes like SHA-256 are too fast: attackers can try billions of guesses per second. Use a slow, purpose-built password hash: bcrypt, scrypt or Argon2, with a tunable cost.

A salt is a random value generated per user and stored with the hash. It ensures two users with the same password get different hashes, and it defeats precomputed rainbow tables. bcrypt and Argon2 generate and embed the salt for you.

import bcrypt from 'bcrypt';
const hash = await bcrypt.hash(plainPassword, 12);     // cost factor 12, salt included
// store hash; at login:
const ok = await bcrypt.compare(attempt, hash);        // constant-time comparison

(Node's built-in crypto.scrypt is a dependency-free alternative.) Also: rate-limit login attempts, never log passwords, and raise the cost factor over time as hardware gets faster.