Hashing Passwords in Node and Express using bcrypt

Learn how to correctly hash and store your passwords for any web app using node.js and express. The only things you need to take away from the video are:
1. Don't store passwords in plain text
2. Hash your passwords using bcrypt
Chapters:
0:00​ Intro
0:30 Hashing with bcrypt
2:30 Other Hashing Algorithms
4:30 Salt
6:30 bcrypt cost factor
9:03 Comparing Passwords
10:28 Express App
16:43 Summary
🔗Moar Links
My Website: www.sammeechward.com
Instagram: / meech_ward
Github: github.com/orgs/Sam-Meech-Ward

[@kemal_ozturk]

I love the little co-pilot interactions lol

[@samsorge27]

I'm amazed how fast you spin up these little express applications to illustrate your point

[@colbr6733]

Thought I already had a good understanding of this theme, however this review uncovers aspects I wasn't aware of. Thanks Sam.

[@matthewc.9437]

You're a wonderful teacher. Appreciate the video.

[@ferreiradelima96]

Your're an excellent teacher.

[@vernevens1598]

Very good video. Simple, to the point without a bunch of clutter, very easy to understand. Thank you.

[@phillymontana]

Really good introduction to bcrypt.

[@BrandonDix-gw7ez]

Great Video, great teaching style

[@vinaykumarkharwar177]

Thank you, that was such a great short introduction, albeit knowledgeful.

[@mohammadaitisamyaseen2564]

Much appreciated! Your video helped me alot. Great teaching method 👍

[@em-kv3lw]

Thank you so much! Super helpful beginner friendly guide.

[@HarisKhan-bh6uj]

Thanks for the helpful video !! helped a lot !!

[@MostafaDeutsch-ex2kb]

Very clear and smart

[@alexdiffodoumtsop3405]

awesome video. thanks dude!

[@youssefahmed8861]

definetly liked this video 👏

[@sofiatachmatzidou175]

This was awesome! Thank you!

[@SamMeechWard]

You're so welcome!

[@pro.grammer]

awesome video thanks!

[@cheesepotato5753]

this video made me understand res and req holy cow

[@vladimirpuma6079]

Great video, thanks!!!

[@technocoh]

Great video, thanks! ;)

[@bigbadcatbigbcy2933]

thanks everything was so celar to understand

[@frfrongong9712]

I cant use await on my bcrypt.compare function, itd already inside an async function, can i get some help

[@rohbarsch1201]

I'm not using JS but this was an excellent tutorial. I'm most curious about the postman add on for vs code.

[@vaibhavgupta973]

thank you !!

[@philipparker113]

Awesome video

[@prabhakarmishra2182]

u explained it very well, do you have courses ?

[@WahYudi-ue2uh]

how can you push on const user?. dont u have to use let user

[@makisetakashi]

which one is better between bcrypt and argon2 ?

[@BrandonAB]

I'm curious, without knowing exactly how the hashing algo does its thing, couldn't I just make up my own algo where a = 5236, b = 5267, c = 4523, so on and so forth, assigning each allowable character a value, then taking those values and do several other things with the result to make the process consistently repeatable so I can compare the result of my "hashing algo" with the original password, instead of using a publicly available tool like bcrypt? What would be the downside to this?

[@SumitSingh-rw2vl]

which tool using in vs code to pull request ?

[@samontefrankamirsong.5474]

I am your biggest fan Christ Martin from Coldplay! omg

[@skyzane2735]

Is this bcrypt still secure these days and standard in storing passwords?
I saw you showed some docs saying use bcrypt as second only against argon2id something

[@xoldyckk176]

Argon2 is the new recommended hashing algorithm. It's more secure than bcrypt.

[@yourfavouriteman]

To use an await function with no async function es bien !!

[@ikechukwualita521]

good job. Please how can i do this in php mysql

[@samontefrankamirsong.5474]

Outrageous - VLDL Benjamin

[@solehudin6861]

What software / app is that? Visual studio code?

[@mateusmiguel_]

is it safe to send the password in the request as plain text? couldn't an unsecured wifi network easily intercept the call and steal the password?

[@helloquestionmark9942]

not if you're running a https network

[@obidkenjayev7062]

Good

[@asaphhere]

Btw is it bad to encrypt username as well? is it bad practice/even more complex?

[@SamMeechWard]

usernames aren't generally sensitive information, we display them publicly, so encryption isn't necessary and just takes more time. If you encrypt a username, you always need to decrypt it to use it. If you store it in a database, it makes looking up some data by a username way more difficult.
Also, keep in mind, that bcrypt is hashing, not encrypting. If you hash a username, you'll never be able to get that username back, so never do that.

[@asaphhere]

@@SamMeechWard thank you and that makes sense. And also thank you for uploading content regarding AWS S3 and other services, you don’t understand how helpful they are. Is there any other way of contacting you?

[@SamMeechWard]

@@asaphhere Thank you. You can join my discord server if you like discord.gg/XQJ5bmjKHk

[@yourfavouriteman]

It should b > npm i bcryptjs

[@Anteater23]

Should you not hash the password before you post it?

[@unhandledexception1948]

@ 1:26 you are awaiting in a top level script / module without using an async IIFE... I thought that is not possible ?

[@SamMeechWard]

It’s fine if you’re using es modules

[@unhandledexception1948]

Thanks ! Yes, I noticed this didn't work when using require() @@SamMeechWard

[@mastuyt6931]

what the hell is going on ?? how can you use await without async???/

[@SamuelAmoh-bu7vg]

not working for me

[@aprilm2941]

I only like hash if it’s got potato in it. 🥔

[@SamMeechWard]

Just don’t forget to add salt ;)

[@zzn-wc7nx]

He's handsome i can't focus sos 🥲