DEV Community

Cover image for How to hash passwords before saving it on database in Node.js
Jahongir Sobirov
Jahongir Sobirov

Posted on

How to hash passwords before saving it on database in Node.js

#beginners #node #security #tutorial

Hashing password plays crucial role on security of systems and networks. So in this post we'll learn how to hash passwords before saving it on database using Node.js. For this we need a authentication library named auth-verify

npm install auth-verify
Enter fullscreen mode Exit fullscreen mode

Making the configuration

For hashing the password we should make correct configuration:

const AuthVerify = require('auth-verify');
const auth = new AuthVerfiy({
  hashAlg: 'pbkdf2', // or 'scrypt'
  iterations: 100000,
  keyLen: 64
});
Enter fullscreen mode Exit fullscreen mode

🔐 hashAlg: 'pbkdf2'

This chooses the hashing algorithm.

pbkdf2

  • Stands for Password-Based Key Derivation Function 2
  • Built into Node.js crypto
  • Designed specifically for passwords

  • Uses:

    • password
    • salt
    • iterations (many rounds)
      • ✔️ Secure

  • ✔️ Battle-tested

  • ✔️ Slower on purpose (good against brute-force)

scrypt (alternative)

  • Even more memory-hard
  • Stronger against GPU attacks
  • Slightly heavier on the server
👉 Rule of thumb:
  • pbkdf2 → safe, standard, widely used
  • scrypt → stronger, modern, more expensive

🔁 iterations: 100000

This is how many times the hash function runs.
Think of it like this:

Instead of hashing once, hash 100,000 times

Why?

  • Makes attacks VERY slow
  • If an attacker tries millions of passwords → 💀 CPU melts Example:
  • 1 iteration → ⚠️ weak
  • 10,000 → okay

  • 100,000 → good (production-level)

  • ✔️ More iterations = more security

  • ❌ Too many = slower login

👉 100_000 is a great balance

🔑 keyLen: 64

This is the length of the final hash (in bytes).

  • 64 bytes = 512 bits
  • Longer hash = harder to crack
  • Stored in DB as hex/base64

Example:

password → pbkdf2 → 64-byte hash
Enter fullscreen mode Exit fullscreen mode
  • ✔️ 32 bytes → ok
  • ✔️ 64 bytes → strong

Hashing the password 

auth.crypto.hash("myPassword123", (err, result)=> {
  if(err) console.log(err);
  console.log(result);
});
Enter fullscreen mode Exit fullscreen mode

Verifying the password 

auth.crypto.verify("secret123", result, (err, valid)=> {
   if(err) console.log(err);
   console.log(valid) // true
});
Enter fullscreen mode Exit fullscreen mode

Full example 

const AuthVerify = require('auth-verify');
const auth = new AuthVerfiy({
  hashAlg: 'pbkdf2', // or 'scrypt'
  iterations: 100000,
  keyLen: 64
});

auth.crypto.hash("myPassword123", (err, result)=> {
  if(err) console.log(err);
  console.log(result);
  auth.crypto.verify("secret123", result, (err, valid)=> {
     if(err) console.log(err);
     console.log(valid) // false
  });
});
Enter fullscreen mode Exit fullscreen mode

Top comments (2)

Collapse
 
nathanjohnnj profile image
Nathan John •

When you use "secret123" to verify the hashed result, how does the initial hashing command know that that secret will be used for verifying? Does the initial command not need to know the secret as well?

Collapse
 
jahongir2007 profile image
Jahongir Sobirov •

The hash doesn’t need to know the password in advance — during verification, the entered password is hashed again with the same salt and configuration, and the two hashes are compared.