node.bcrypt.js is a library for hashing passwords in Node.js applications.
The library addresses the critical need to securely store passwords by implementing the bcrypt algorithm, which is designed to be computationally expensive and resistant to brute-force attacks. It wraps the bcrypt algorithm in a Node.js-compatible interface, handling the complexity of password hashing and verification so developers do not need to implement these security-sensitive operations themselves.
Developers should adopt this library if they are building Node.js applications that require password storage and authentication. It is suitable for any project handling user credentials, from small applications to large-scale systems. The library supports both $2a$ and $2b$ prefix bcrypt hashes and maintains backward compatibility with hashes generated by earlier versions, allowing for straightforward migration. The README emphasizes that users must run stable versions of Node.js, as the library uses node-gyp for compilation and does not support unstable Node releases.
The project maintains strict requirements around bug reporting, requesting that issues include sufficient reproducible code snippets or logs and that only stable Node.js versions be used when filing reports. The README contains detailed security documentation, including warnings about critical vulnerabilities in versions prior to v5.0.0 that could lead to severely weakened passwords through truncation or improper handling of NUL characters, with explicit guidance to upgrade. The library documents version compatibility across a wide range of Node.js releases and notes that only the first 72 bytes of passwords are used during matching, with special attention to UTF-8 encoding implications for multi-byte characters.
