Password Hashing (bcrypt)

Definition

A password-hashing function designed to be computationally expensive to thwart brute-force search attacks. It is the industry standard for securely storing passwords.

Explain Like I'm New

If you save `password: "ilovecats123"` in your database, and your database gets hacked, all your users are compromised. `bcrypt` takes that password, throws it into a blender, and outputs gibberish like `$2b$10$X1...`. If the hacker steals the gibberish, they cannot reverse it back to 'ilovecats123'.

Real World Example

When a user registers, you hash their password using `bcrypt.hash()`. When they try to log in, you don't un-hash the DB password; you hash their attempted password using `bcrypt.compare()` and see if the two gibberish strings match.

Common Use Cases

•User registration
•Authentication

Interactive Example

Console output will appear here...

Interview Questions

basic

Should you ever store plain-text passwords in a database?

intermediate

What is a 'Salt' in cryptography?

advanced

Why is bcrypt intentionally designed to be slow?

Flash Cards

Question

What is a Salt?

Click to reveal answer

Answer

A random string of characters added to the password BEFORE it is hashed. This ensures that if two users have the exact same password ('12345'), their final hashes will look completely different, protecting them from Rainbow Table attacks. Bcrypt generates and applies salts automatically.

Question

Why intentionally slow?

Click to reveal answer

Answer

To protect against brute-force attacks. A hacker with a powerful GPU can guess billions of fast MD5 hashes a second. Bcrypt forces a computationally heavy 'cost factor' (rounds). You can configure it so calculating ONE hash takes 0.5 seconds. At that speed, guessing passwords would take a hacker billions of years.