Hashing Passwords in Node and Express using bcrypt

Learn how to correctly hash and store your passwords for any web app using node.js and express. The only things you need to take away from the video are:
1. Don't store passwords in plain text
2. Hash your passwords using bcrypt
Chapters:
0:00​ Intro
0:30 Hashing with bcrypt
2:30 Other Hashing Algorithms
4:30 Salt
6:30 bcrypt cost factor
9:03 Comparing Passwords
10:28 Express App
16:43 Summary
🔗Moar Links
My Website: www.sammeechward.com
Instagram: / meech_ward
Github: github.com/orgs/Sam-Meech-Ward

[@colbr6733]

Thought I already had a good understanding of this theme, however this review uncovers aspects I wasn't aware of. Thanks Sam.

[@samsorge27]

I'm amazed how fast you spin up these little express applications to illustrate your point

[@kemal_ozturk]

I love the little co-pilot interactions lol

[@matthewc.9437]

You're a wonderful teacher. Appreciate the video.

[@vernevens1598]

Very good video. Simple, to the point without a bunch of clutter, very easy to understand. Thank you.

[@vinaykumarkharwar177]

Thank you, that was such a great short introduction, albeit knowledgeful.

[@mohammadaitisamyaseen2564]

Much appreciated! Your video helped me alot. Great teaching method 👍

[@em-kv3lw]

Thank you so much! Super helpful beginner friendly guide.

[@phillymontana]

Really good introduction to bcrypt.

[@BrandonDix-gw7ez]

Great Video, great teaching style

[@ferreiradelima96]

Your're an excellent teacher.

[@HarisKhan-bh6uj]

Thanks for the helpful video !! helped a lot !!

[@alexdiffodoumtsop3405]

awesome video. thanks dude!

[@sofiatachmatzidou175]

This was awesome! Thank you!

[@SamMeechWard]

You're so welcome!

[@vladimirpuma6079]

Great video, thanks!!!

[@youssefahmed8861]

definetly liked this video 👏

[@rohbarsch1201]

I'm not using JS but this was an excellent tutorial. I'm most curious about the postman add on for vs code.

[@pro.grammer]

awesome video thanks!

[@MostafaDeutsch-ex2kb]

Very clear and smart

[@technocoh]

Great video, thanks! ;)

[@cheesepotato5753]

this video made me understand res and req holy cow

[@bigbadcatbigbcy2933]

thanks everything was so celar to understand

[@philipparker113]

Awesome video

[@vaibhavgupta973]

thank you !!

[@prabhakarmishra2182]

u explained it very well, do you have courses ?

[@skyzane2735]

Is this bcrypt still secure these days and standard in storing passwords?
I saw you showed some docs saying use bcrypt as second only against argon2id something

[@samontefrankamirsong.5474]

Outrageous - VLDL Benjamin

[@samontefrankamirsong.5474]

I am your biggest fan Christ Martin from Coldplay! omg

[@frfrongong9712]

I cant use await on my bcrypt.compare function, itd already inside an async function, can i get some help

[@obidkenjayev7062]

Good

[@BrandonAB]

I'm curious, without knowing exactly how the hashing algo does its thing, couldn't I just make up my own algo where a = 5236, b = 5267, c = 4523, so on and so forth, assigning each allowable character a value, then taking those values and do several other things with the result to make the process consistently repeatable so I can compare the result of my "hashing algo" with the original password, instead of using a publicly available tool like bcrypt? What would be the downside to this?

[@xoldyckk176]

Argon2 is the new recommended hashing algorithm. It's more secure than bcrypt.

[@makisetakashi]

which one is better between bcrypt and argon2 ?

[@solehudin6861]

What software / app is that? Visual studio code?

[@yourfavouriteman]

To use an await function with no async function es bien !!

[@mateusmiguel_]

is it safe to send the password in the request as plain text? couldn't an unsecured wifi network easily intercept the call and steal the password?

[@helloquestionmark9942]

not if you're running a https network

[@SumitSingh-rw2vl]

which tool using in vs code to pull request ?

[@WahYudi-ue2uh]

how can you push on const user?. dont u have to use let user

[@ikechukwualita521]

good job. Please how can i do this in php mysql

[@asaphhere]

Btw is it bad to encrypt username as well? is it bad practice/even more complex?

[@SamMeechWard]

usernames aren't generally sensitive information, we display them publicly, so encryption isn't necessary and just takes more time. If you encrypt a username, you always need to decrypt it to use it. If you store it in a database, it makes looking up some data by a username way more difficult.
Also, keep in mind, that bcrypt is hashing, not encrypting. If you hash a username, you'll never be able to get that username back, so never do that.

[@asaphhere]

@@SamMeechWard thank you and that makes sense. And also thank you for uploading content regarding AWS S3 and other services, you don’t understand how helpful they are. Is there any other way of contacting you?

[@SamMeechWard]

@@asaphhere Thank you. You can join my discord server if you like discord.gg/XQJ5bmjKHk

[@Anteater23]

Should you not hash the password before you post it?

[@yourfavouriteman]

It should b > npm i bcryptjs

[@unhandledexception1948]

@ 1:26 you are awaiting in a top level script / module without using an async IIFE... I thought that is not possible ?

[@SamMeechWard]

It’s fine if you’re using es modules

[@unhandledexception1948]

Thanks ! Yes, I noticed this didn't work when using require() @@SamMeechWard

[@SamuelAmoh-bu7vg]

not working for me

[@aprilm2941]

I only like hash if it’s got potato in it. 🥔

[@SamMeechWard]

Just don’t forget to add salt ;)

[@mastuyt6931]

what the hell is going on ?? how can you use await without async???/

[@zzn-wc7nx]

He's handsome i can't focus sos 🥲