Skip to main content
Tweeted twitter.com/StackSecurity/status/1000325821301755909
easier to understand variable name
Source Link
edencorbin
  • 423
  • 1
  • 4
  • 7

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing the salt is necessary at all. Indeed I used this code to create salt and hashed password:

 let salt = await bcrypt.genSalt(10); const saltpasshash = await new Promise((resolve, reject) => { bcrypt.hash(plain_text_password, salt, function(err, hash) { if (err) reject(err) resolve(hash) }); }) //NOTE I SAVE saltpasshash as users pass and the salt in a separate field in the users table. 

This works, what I am confused about is it will then return a valid result if I compare as follows:

valid = await bcrypt.compare(passwordplain_text_password, user.saltpasshash); 

I'm confused as to why this would be valid when I am not providing the salt, and if so, why store the salt at all?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing the salt is necessary at all. Indeed I used this code to create salt and hashed password:

 let salt = await bcrypt.genSalt(10); const saltpasshash = await new Promise((resolve, reject) => { bcrypt.hash(plain_text_password, salt, function(err, hash) { if (err) reject(err) resolve(hash) }); }) //NOTE I SAVE saltpasshash as users pass and the salt in a separate field in the users table. 

This works, what I am confused about is it will then return a valid result if I compare as follows:

valid = await bcrypt.compare(password, user.saltpasshash); 

I'm confused as to why this would be valid when I am not providing the salt, and if so, why store the salt at all?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing the salt is necessary at all. Indeed I used this code to create salt and hashed password:

 let salt = await bcrypt.genSalt(10); const saltpasshash = await new Promise((resolve, reject) => { bcrypt.hash(plain_text_password, salt, function(err, hash) { if (err) reject(err) resolve(hash) }); }) //NOTE I SAVE saltpasshash as users pass and the salt in a separate field in the users table. 

This works, what I am confused about is it will then return a valid result if I compare as follows:

valid = await bcrypt.compare(plain_text_password, user.saltpasshash); 

I'm confused as to why this would be valid when I am not providing the salt, and if so, why store the salt at all?

Source Link
edencorbin
  • 423
  • 1
  • 4
  • 7

bcrypt no need to store salt?

I'm confused with bcrypt, I would think I would need to store my salt, and then compare my plain text password + salt to the hashed password, however from documentation it does not look like storing the salt is necessary at all. Indeed I used this code to create salt and hashed password:

 let salt = await bcrypt.genSalt(10); const saltpasshash = await new Promise((resolve, reject) => { bcrypt.hash(plain_text_password, salt, function(err, hash) { if (err) reject(err) resolve(hash) }); }) //NOTE I SAVE saltpasshash as users pass and the salt in a separate field in the users table. 

This works, what I am confused about is it will then return a valid result if I compare as follows:

valid = await bcrypt.compare(password, user.saltpasshash); 

I'm confused as to why this would be valid when I am not providing the salt, and if so, why store the salt at all?