bcrypt.js

bcryptjs is a pure JavaScript port of the bcrypt password-hashing algorithm, built to be a drop-in, dependency-free alternative to the native C++ bcrypt binding for Node.js. It works anywhere JavaScript runs, including browsers, by relying on the Web Crypto API or Node’s crypto module for secure randomness, with a pluggable fallback for other environments.

The library exposes both synchronous and asynchronous (promise or callback-based) APIs for generating salts, hashing passwords, and comparing hashes, while remaining wire-compatible with hashes produced by the original bcrypt implementation. Because it ships as an ECMAScript module with a UMD fallback and TypeScript type definitions, it drops into modern bundlers, older CommonJS projects, and browser-only builds without a native compilation step.

What You Get

• Synchronous and asynchronous APIs (hashSync/hash, compareSync/compare) supporting promises or Node-style callbacks
• Configurable salt generation via genSalt/genSaltSync with an adjustable cost factor (rounds)
• Zero runtime dependencies, with automatic use of the Web Crypto API or Node’s crypto module for secure random bytes, plus a setRandomFallback hook for constrained environments
• Cross-format compatibility, correctly hashing and comparing against $2a$, $2b$, and $2y$ prefixed hashes produced by other bcrypt implementations
• TypeScript type declarations and both ESM and UMD builds for use in Node.js, bundlers, and directly in browsers
• A small CLI (bcrypt <input> [rounds|salt]) for quick command-line hashing

Common Use Cases

• Hashing user passwords before storing them in a database during signup or password-change flows
• Verifying a submitted login password against a stored bcrypt hash
• Hashing credentials in browser-based or edge/serverless environments where native Node.js addons aren’t available
• Replacing the native bcrypt package in projects where native compilation (node-gyp) is problematic in CI or deployment

Under The Hood

Architecture — The entire library lives in a single ~1,150-line index.js module (Blowfish cipher core, base64 codec using bcrypt’s custom alphabet, and the public salt/hash/compare API) with no internal package boundaries; execution flows from genSalt(Sync) (builds a $2b$<rounds>$<salt> string using randomBytes, sourced from the Web Crypto API with a Node crypto fallback and a user-settable setRandomFallback) into hash(Sync)/compare(Sync), which run the Blowfish-based Eksblowfish key schedule directly in JS; async variants chunk the round computation and yield to the event loop via MAX_EXECUTION_TIME-bounded slices with an optional ProgressCallback, avoiding blocking Node’s single thread on high cost factors. Tech Stack — Zero runtime dependencies; the module is authored as a native ES module ("type": "module") with a companion umd/ build generated at publish time by scripts/build.js via the esm2umd transpiler and reformatted with Prettier, giving consumers both an ESM entry (index.js) and a UMD/CommonJS entry (umd/index.js) plus hand-maintained .d.ts type declarations (types.d.ts) copied into both output paths; a bin/bcrypt script exposes the same API as a one-off CLI. Code Quality — tests/index.js is a flat array of self-registered test functions (no framework) that assert against assert/assert.strictEqual/assert.deepEqual, including a cross-check against the native bcrypt npm package (bcrypt-nodejs/C++ binding) as a devDependency to confirm hash format and comparison compatibility across $2a$, $2b$, and $2y$ prefixes; there is no formal linter beyond Prettier --check, and the source relies on var-based ES5-style internals despite being distributed as ESM, reflecting its long maintenance history since 2013. API Design — The public surface intentionally mirrors the native Node bcrypt package’s function names and call signatures (hashSync, hash, compareSync, compare, genSalt(Sync)) so it acts as a drop-in substitute, supports both promise-based and Node-style callback usage on every async function, and documents defaults (10 rounds) so most callers can call bcrypt.hash(password, 10) with no further configuration.