bcrypt

bcrypt is the de facto Node.js library for securely hashing and verifying user passwords. It wraps a native C++ implementation of the OpenBSD bcrypt algorithm, exposing a tiny, focused API for generating salts, hashing passwords with a configurable work factor, and constant-time comparison against stored hashes.

Designed for real-world authentication systems, it offers callback, Promise, and synchronous variants, ships prebuilt binaries for common platforms, and deliberately keeps its surface area small so teams can adopt safe password storage without wiring together low-level cryptographic primitives themselves.

What You Get

• A native C++ implementation of the OpenBSD bcrypt algorithm exposed through a clean JavaScript API.
• Async (callback), Promise, and synchronous variants of every core operation for flexible integration.
• Automatic salt generation with a configurable work factor (cost rounds) to tune resistance against brute-force attacks.
• Prebuilt binaries for Windows, Linux (glibc and musl), and macOS across x64 and arm64, with source-build fallback via node-gyp.

Common Use Cases

• Hashing user passwords before persisting them in a database during signup.
• Verifying a submitted password against a stored hash during login.
• Upgrading legacy password storage to a modern, adaptive hashing scheme.

Under The Hood

Architecture — The public surface lives in bcrypt.js, a thin JavaScript layer that validates arguments and delegates to a native addon loaded via node-gyp-build. The native side (src/bcrypt_node.cc, src/bcrypt.cc, src/blowfish.cc, src/node_blf.h) ports the OpenBSD bcrypt/Blowfish implementation and is bridged through node-addon-api (N-API). Async operations dispatch to libuv’s thread pool so CPU-intensive hashing never blocks the event loop, while *Sync calls run inline. Salt entropy comes from Node’s built-in crypto.randomBytes, and promises.js supplies a pluggable Promise wrapper when no callback is passed.

Tech Stack — The codebase is roughly 51% C++, 38% JavaScript, and 6% C. Runtime dependencies are minimal: node-addon-api (^8.3.0) for the N-API bindings and node-gyp-build (^4.8.4) for loading prebuilt or source-compiled binaries. Builds use prebuildify with node-gyp/binding.gyp, and the library targets Node 18+.

Code Quality — The repository ships a Jest suite spanning five files (async.test.js, promise.test.js, sync.test.js, implementation.test.js, repetitions.test.js) that exercise the sync, callback, and Promise paths plus edge cases. The JavaScript layer performs thorough argument validation, routes errors to callbacks via process.nextTick (or rejected Promises) rather than throwing inconsistently, and keeps naming conventional and predictable.

API Design — The API is deliberately minimal and ergonomic: genSalt/genSaltSync, hash/hashSync, compare/compareSync, and getRounds. Each async method transparently returns a Promise when no callback is supplied, so callback, Promise, and async/await styles all work without configuration. Sensible defaults (10 rounds) and the ability to pass a cost number directly to hash minimize boilerplate for the common case.