Wie in Verwenden bcrypt für Passwort Hashing

问题

You brauchen in speichern Benutzer passwords securely also das sogar wenn der Datenbank ist compromised, der passwords kann nicht sein recovered.

Voraussetzungen

• Understanding of hashing vs encryption
• Knowledge of salt and cost factor

Schritte

1. 1. Choose a cost factor

   The bcrypt cost factor determines how many iterations the hashing runs. A cost of 10 takes about 100ms; each increment doubles the time. Choose the highest cost your server can afford during login (typically 10-12).

   Eingabe

   cost: 12

   输出

   ~400ms per hash

2. 2. Hash the password with a generated salt

   bcrypt automatically generates a random salt and embeds it in the hash. You do not need to manage the salt separately. The output is a single string containing the algorithm, cost, salt, and hash.

   Eingabe

   password: 'correct horse'

   输出

   $2b$12$...salt+hash...

3. 3. Verify on login

   To check a password, pass the candidate password and the stored bcrypt hash to the verify function. It extracts the salt and cost from the hash and re-computes, then compares the result. Never compare hashes manually with ==.

   Eingabe

   candidate + stored hash

   输出

   true / false

Erwartetes Ergebnis

Ein bcrypt Hash Zeichenkette das kann verifizieren passwords ohne storing der plaintext, mit adjustable funktionieren factor.

Häufige Fehler

Cost factor too low

A cost below 10 is too fast for modern hardware. Increase to at least 10-12 to resist GPU brute force.

Using a fixed salt

Let bcrypt generate a random salt per password. A fixed salt enables precomputation attacks like rainbow tables.

Troubleshooting指引

• If hashing is too slow, lower the cost by 1. If too fast, raise it.
• If verify always returns false, check that you are passing the full bcrypt hash string, not just the hash portion.

Sicherheitsgrenzen

• bcrypt has a 72-byte password limit; longer passwords are truncated. Pre-hash with SHA-256 if you need to support longer passwords.
• All hashing is done locally; no password leaves your browser.