# calibrate-bcrypt-rounds

> Calculate bcrypt rounds on the fly rather than hardcoding a specific number

Latest version **1.1.1** (published 2018-10-29) · MIT license · 0 weekly downloads

## Install

```sh
npm install calibrate-bcrypt-rounds
pnpm add calibrate-bcrypt-rounds
yarn add calibrate-bcrypt-rounds
bun add calibrate-bcrypt-rounds
```

## Health

**Score 15/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 1.1.1 |
| Published | 2018-10-29 |
| First published | 2018-08-24 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 2 |
| Unpacked size | 9.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 0 |
| Author | Dave Wasmer |
| Maintainers | davewasmer |

## Links

- npm: https://www.npmjs.com/package/calibrate-bcrypt-rounds
- Repository: https://github.com/davewasmer/calibrate-bcrypt-rounds
- Homepage: https://github.com/davewasmer/calibrate-bcrypt-rounds#readme
- Issues: https://github.com/davewasmer/calibrate-bcrypt-rounds/issues
- npm.io page: https://npm.io/package/calibrate-bcrypt-rounds

## Dependencies (2)

- [@types/jest](https://npm.io/package/@types/jest.md) ^23.3.1
- [@types/node](https://npm.io/package/@types/node.md) ^10.9.0

## Recent versions

- 1.1.1 (latest) — 2018-10-29
- 1.1.0 — 2018-08-24

## README

# calibrate-bcrypt-rounds

![Build Status](https://img.shields.io/circleci/project/github/davewasmer/calibrate-bcrypt-rounds/master.svg?style=flat-square)

> Calculate bcrypt rounds on the fly rather than hardcoding a specific number

## Installation

```
$ yarn add calibrate-bcrypt-rounds
```

## Usage

```js
import calibrate from 'calibrate-bcrypt-rounds';
import bcrypt from 'bcryptjs';

// Note how the calibrate function is called once, when the module is loaded
const rounds = await calibrate(bcrypt, 241);

export default async function hashPassword(password) {
  return bcrypt.hash(password, rounds);
}
```

**Note:** using `calibrate` will help pick the right cost factor every time
you restart or redeploy your app. But it won't update old passwords hashed
with fewer rounds. As you check passwords, you should also check to see if
they need to be rehashed with more rounds to keep them secure, i.e.:

```js
if (await bcrypt.compare(req.body.password, user.hashedPassword)) {
  // User has authenticated, now rehash password if needed
  if (bcrypt.getRounds(user.hashedPassword) < myAppConfig.bcryptRoundsFromCalibration) {
    user.hashedPassword = await bcrypt.hash(req.body.password, myAppConfig.bcryptRoundsFromCalibration);
    await user.save();
  }
  // ...
}

## Motivation

bcrypt is an adaptive hashing function, meaning that it accepts a `cost` (or
`rounds`) parameter determines how much work to perform. When bcrypt was
first released in 1999, the original suggested cost factor was 6. Today
(2018), thanks to faster hardware, that recommendation is now somewhere
between 11 and 14 (each increment of the cost factor doubles the work).

Rather than hardcoding a specific cost factor into your code (which will likely
become out date in a year), you should instead calculate an appropriate cost
factor based on how long you want it to take to calculate.

This module automates that process by running bcrypt with progressively
increasing cost factors until it takes at least as long as you specify to
hash a password.

See [this Security StackExchange answer](https://security.stackexchange.com/questions/3959/recommended-of-iterations-when-using-pkbdf2-sha256/3993#3993)
for more detail.

---
_Source: https://npm.io/package/calibrate-bcrypt-rounds · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._