Salt Hash passwords using NodeJS crypto

In the world of web development, securing user data is paramount, especially when it comes to storing passwords. One of the most effective ways to secure passwords is through a process known as salt hashing. This article will guide you through the process of salt hashing passwords using Node.js Crypto.

What is Salt Hashing?

Salt hashing is a technique where we take a user’s password and a random string of characters, known as a salt, combine them, and then hash the resulting string using a suitable hashing algorithm. The hashed result is then stored in the database.

Why Use Salt Hashing?

Hashes of the same password are identical, making them easier to crack using lookup tables and rainbow tables. These are methods where someone pre-calculates the hashes of common passwords and stores them for others to use. Having the same password hash for two or more users also makes it easier for an attacker to predict the password. Therefore, no two users should have the same password hash. Adding a salt to a password and then hashing the result reduces the possibility of having duplicate hashes. If your salt length is long enough, the chances of duplication are minimal.

Practical Implementation

Here’s a step-by-step guide on how to implement salt hashing:

Creating and Storing Password

1. Take the user’s password.
2. Generate a salt (a string of random characters).
3. Combine the salt with the user’s password.
4. Hash the combined string with a suitable cryptographic algorithm.
5. Store the resulting hash and the salt in the database.

Validating User Password

1. Validate the username and fetch the hashed result and salt from the database.
2. Combine the user-entered password with the stored salt.
3. Hash the combined string with the same cryptographic algorithm used when creating the user.
4. Compare the resulting hash with the stored hash.

Code Implementation

The following code snippets demonstrate how to implement salt hashing using Node.js Crypto:

'use strict';
var crypto = require('crypto');

var genRandomString = function(length){
  return crypto.randomBytes(Math.ceil(length/2))
  .toString('hex')
  .slice(0,length);
};

var sha512 = function(password, salt){
  var hash = crypto.createHmac('sha512', salt);
  hash.update(password);
  var value = hash.digest('hex');
  return {
    salt:salt,
    passwordHash:value
  };
};

function saltHashPassword(userpassword) {
  var salt = genRandomString(16);
  var passwordData = sha512(userpassword, salt);
  console.log('UserPassword = '+userpassword);
  console.log('Passwordhash = '+passwordData.passwordHash);
  console.log('\\nSalt = '+passwordData.salt);
}

saltHashPassword('MYPASSWORD');
saltHashPassword('MYPASSWORD');

Conclusion

If you’re working on a web application that stores user passwords, it’s crucial to get things right. Salt hashing is a highly recommended technique for storing passwords. However, it’s essential to stay updated with the latest techniques for storing passwords, as cryptographic hashing techniques can become compromised over time due to advances in computing power.