search

dcodeIO / bcrypt.js

Optimized bcrypt in plain JavaScript with zero dependencies.
Other
3.47k stars 264 forks source link

Any security downsides to auto-generating salt? #128

Open pietrorea opened 2 years ago

pietrorea commented 2 years ago

Hello :wave: — are there any known security implications for generating the salt separately from the hashing call? Specifically...

Doing them separate:

var salt = bcrypt.genSaltSync(10);
var hash = bcrypt.hashSync("aPassword", salt);

All in one go:

const passwordHash = bcrypt.hashSync('aPassword', 10);

I guess you could provide your own salt? Is that a common practice? Otherwise, why did you include two separate ways to achieve the same thing in the API?