There are several bcrypt libraries that are available for JavaScript:
- bcrypt ( node.bcrypt.js): This is the most performant and efficient implementation of the bcrypt algorithm because it uses the C++ implementation and simply binds it to Node. However, it has a lot of dependencies and restrictions that make it messy to work with, notably:
- Python 2.x.
- node-gyp: Because bcrypt is written as a Node.js add-on, it is written in C++ and must be compiled for your machine's architecture before it can be used. This means that it must depend on node-gyp for its building and installation process. node-gyp only works with Long Term Support (LTS) versions of Node.
- bcryptjs (npmjs.com/package/bcryptjs): A standalone JavaScript implementation of bcrypt that does not have external dependencies. Because it is not running on a low-level language like C++, it is slightly (30%) slower. This means that it cannot process as many iterations per unit time as a more efficient implementation. It has the same interface as the bcrypt package and can also be run in the browser, where it relies on the standardized Web Crypto API to generate random numbers.
- bcrypt-nodejs: An unmaintained predecessor to bcryptjs.
Therefore, the choice is between performance (bcrypt) and the ease of setup (bcryptjs).
Don't get confused. A cryptographic hashing algorithm should be slow; the slower it is, the more secure it is. However, you should always assume that an attacker uses the quickest implementation of the algorithm possible, and thus we should also use the quickest implementation whenever possible. Therefore, purely from a security point of view, the bcrypt package is preferred to bcryptjs because it is the quickest implementation for JavaScript.
We will use the bcryptjs package for now, as it is the simplest to set up. But after you've completed all the exercises in this book, feel free to switch to using the bcrypt package for an extra performance boost. Since the bcryptjs package is 100% compatible with the bcrypt package, all you need to do is update the import statement; everything else can be kept the same.