Skip to main content
Node.jsIntermediate10 min read2026-03-01

Express.js Authentication with JWT & Bcrypt

Implement secure password hashing with bcrypt, JWT token issuance, and protected route middleware.

Prerequisites

  • Basic Express knowledge

1. Password Hashing with Bcrypt

Always hash passwords with a salt cost factor of 10 or 12 before storing.

javascript
const bcrypt = require('bcryptjs');

async function hashPassword(plainText) {
  const salt = await bcrypt.genSalt(10);
  return bcrypt.hash(plainText, salt);
}

async function verifyPassword(plainText, hash) {
  return bcrypt.compare(plainText, hash);
}

Best Practices & Architecture Advice

  • Never log raw passwords or plain tokens to stdout or application logs.

Common Mistakes to Watch Out For

  • Using MD5 or SHA256 without salt to store user passwords.

Frequently Asked Questions

Why is bcrypt preferred over raw SHA256 for passwords?

Bcrypt is intentionally slow and CPU-intensive with a configurable work factor, making brute-force cracking mathematically infeasible.