Cómo a Usar bcrypt para Contraseña Hashing

问题

You necesitar a almacenar usuario passwords securely así que ese incluso si el base de datos es compromised, el passwords no puede ser recovered.

Requisitos previos

• Understanding of hashing vs encryption
• Knowledge of salt and cost factor

Pasos

1. 1. Choose a cost factor

   The bcrypt cost factor determines how many iterations the hashing runs. A cost of 10 takes about 100ms; each increment doubles the time. Choose the highest cost your server can afford during login (typically 10-12).

   entrada

   cost: 12

   输出

   ~400ms per hash

2. 2. Hash the password with a generated salt

   bcrypt automatically generates a random salt and embeds it in the hash. You do not need to manage the salt separately. The output is a single string containing the algorithm, cost, salt, and hash.

   entrada

   password: 'correct horse'

   输出

   $2b$12$...salt+hash...

3. 3. Verify on login

   To check a password, pass the candidate password and the stored bcrypt hash to the verify function. It extracts the salt and cost from the hash and re-computes, then compares the result. Never compare hashes manually with ==.

   entrada

   candidate + stored hash

   输出

   true / false

Resultado esperado

Un bcrypt hash cadena ese puede verificar passwords sin storing el plaintext, con adjustable funcionar factor.

Errores comunes

Cost factor too low

A cost below 10 is too fast for modern hardware. Increase to at least 10-12 to resist GPU brute force.

Using a fixed salt

Let bcrypt generate a random salt per password. A fixed salt enables precomputation attacks like rainbow tables.

Solución de problemas指引

• If hashing is too slow, lower the cost by 1. If too fast, raise it.
• If verify always returns false, check that you are passing the full bcrypt hash string, not just the hash portion.

Límites de seguridad

• bcrypt has a 72-byte password limit; longer passwords are truncated. Pre-hash with SHA-256 if you need to support longer passwords.
• All hashing is done locally; no password leaves your browser.