How to Hash Passwords in Node.js: bcrypt vs crypto (Complete Developer Guide)

Introduction

If you're building any application with user authentication, password security should be your top priority. One of the most critical steps is hashing passwords correctly.

In Node.js, developers commonly use two approaches:

• bcrypt (recommended)
• Node.js built-in crypto module

But which one should you use? And how do you implement them securely?

In this guide, you’ll learn:

• How password hashing works in Node.js
• bcrypt vs crypto comparison
• Secure implementation with code examples
• Common mistakes to avoid

You can also experiment with hashing using this tool:

👉 https://www.mydevtoolhub.com/tools/hash-generator

Why Hash Passwords?

Before jumping into code, let’s understand why hashing is necessary.

Without Hashing:

{
  "email": "user@example.com",
  "password": "mypassword123"
}

If your database is leaked → all passwords are exposed.

With Hashing:

{
  "email": "user@example.com",
  "password": "$2b$10$Xyz..."
}

Now attackers cannot directly read passwords.

Option 1: Using bcrypt (Recommended)

What is bcrypt?

bcrypt is a library specifically designed for hashing passwords securely.

Why bcrypt is Preferred:

• Built-in salting
• Adjustable cost factor
• Slow hashing (prevents brute force)

Install bcrypt

npm install bcrypt

Example: Hashing Password with bcrypt

const bcrypt = require('bcrypt');

async function hashPassword(password) {
  const saltRounds = 10;
  const hash = await bcrypt.hash(password, saltRounds);
  return hash;
}

hashPassword('myPassword123').then(console.log);

Example: Verifying Password

const bcrypt = require('bcrypt');

async function verifyPassword(password, hash) {
  const isMatch = await bcrypt.compare(password, hash);
  return isMatch;
}

Option 2: Using Node.js crypto

What is crypto?

crypto is a built-in Node.js module for cryptographic operations.

It supports hashing algorithms like:

• SHA-256
• SHA-512

Example: Hashing with crypto

const crypto = require('crypto');

function hashPassword(password) {
  return crypto
    .createHash('sha256')
    .update(password)
    .digest('hex');
}

console.log(hashPassword('myPassword123'));

Problem with crypto (Important)

While crypto is powerful, using it directly for passwords is risky.

Issues:

• No built-in salting
• Fast hashing → vulnerable to brute force
• Requires manual security handling

Improving crypto with Salt

const crypto = require('crypto');

function hashPassword(password, salt) {
  return crypto
    .createHmac('sha256', salt)
    .update(password)
    .digest('hex');
}

Even with this, it's still not as secure as bcrypt.

bcrypt vs crypto (Detailed Comparison)

When Should You Use bcrypt?

Use bcrypt when:

• Storing user passwords
• Building authentication systems
• Handling sensitive credentials

When Should You Use crypto?

Use crypto when:

• Hashing files
• Generating tokens
• Creating signatures

Real-World Scenario

Scenario: Login System

❌ Using crypto (bad example):

• Fast hashing → attacker can brute force quickly

✅ Using bcrypt:

• Slow hashing → attacker cannot easily crack passwords

Best Practices for Password Hashing

1. Always Use bcrypt or Argon2

Never use MD5 or plain SHA-256.

2. Use Proper Salt Rounds

Typical value: 10–12

3. Never Store Plain Passwords

4. Use HTTPS

Protect passwords during transmission.

5. Implement Rate Limiting

Prevent brute force attacks.

Performance Considerations

bcrypt is intentionally slow.

Why?

To make brute-force attacks expensive.

Example:

• crypto hash → milliseconds
• bcrypt hash → 100+ ms

Testing Hashes Quickly

Use this tool to understand hashing behavior:

👉 https://www.mydevtoolhub.com/tools/hash-generator

Common Developer Mistakes

• Using SHA-256 directly for passwords
• Not using salt
• Storing passwords in logs
• Using low cost factor

Advanced Tip: Async vs Sync

Always use async bcrypt functions in production.

await bcrypt.hash(password, 10);

FAQs

Is bcrypt better than crypto?

Yes, for password hashing.

Can I use SHA-256 for passwords?

Not recommended alone.

What is salt in bcrypt?

Random data added automatically.

How many salt rounds should I use?

10–12 is standard.

Is bcrypt slow?

Yes, intentionally for security.

Should I use crypto at all?

Yes, but not for password hashing.

Final Summary

• bcrypt = best for passwords
• crypto = general-purpose hashing

If you're building authentication systems, always choose bcrypt.

Final Thoughts

Password security is not optional—it’s essential.

Using the wrong hashing method can expose millions of users.

Start experimenting with hashing using:

👉 https://www.mydevtoolhub.com/tools/hash-generator

Master bcrypt and secure coding practices to build safe and scalable applications.