How should you store passwords?
Model answer
Never store plain text. Hash with a slow, salted algorithm such as bcrypt (or argon2) and store only the hash. On login, compare the entered password with the hash using bcrypt.compare. Never log passwords or return the hash in API responses.
Learn this topic
Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.
More questions
- What is a JWT and how is it used for login?
- What is the difference between authentication and authorisation?
- How do you write authentication middleware in Express?
- Where should you store a JWT in the browser?
- What is an ownership check and why is it important?
- What do helmet and rate limiting protect against?