Typorithm · medium

Password Hashing

password-hashingsecuritybcryptsaltargon2

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Password Hashing

Auth & Identity

Never store plaintext passwords. Use a slow, salted, adaptive hash — bcrypt, scrypt, or argon2id. A unique salt per password defeats rainbow tables, and a tunable cost factor makes brute force expensive. bcrypt.compare verifies a candidate safely.

Storing passwords as plaintext (or with a fast hash like MD5/SHA-256) is a critical mistake: one database leak exposes every account. Instead, run each password through a slow, adaptive hash designed for the job.

bcrypt.hash(password, 12) generates a random per-password salt and embeds it in the output, so identical passwords produce different hashes and precomputed rainbow tables are useless. The cost factor 12 controls the work, and you raise it as hardware gets faster.

To log a user in, call bcrypt.compare(password, hash): it extracts the salt from the stored hash, re-derives the candidate, and compares safely. For new systems, argon2id — which is memory-hard — is the current recommended algorithm.

Never store plaintext; use a slow, salted hash.

A unique salt per password defeats rainbow tables.

argon2id is the modern recommendation; bcrypt is solid.

import bcrypt from "bcrypt";
const hash = await bcrypt.hash(password, 12);
const ok = await bcrypt.compare(password, hash);
// argon2id is the modern recommendation

Read the implementation

Connect each part of the code to the concept before you type.

1. Hashing library

bcrypt is a slow, adaptive password hash that bundles a per-password salt.

import bcrypt from "bcrypt";

2. Hash a password

bcrypt.hash generates a random salt, mixes it in, and stores it inside the resulting hash string.

const hash = await bcrypt.hash(password, 12);

3. Cost factor

The cost (work factor) 12 sets how many rounds bcrypt runs, making each guess expensive to compute.

4. Verify a password

bcrypt.compare re-hashes the candidate with the stored salt and checks it in constant time.

const ok = await bcrypt.compare(password, hash);

5. Modern choice

argon2id is memory-hard and the current OWASP recommendation for new password hashing.

// argon2id is the modern recommendation

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.