Common Password Hashing Mistakes (and How to Avoid Them)

Common Password Hashing Mistakes

Hashing passwords wrong defeats the purpose. Here are common mistakes and how to avoid them.

Mistake 1: Storing Passwords in Plain Text

The worst mistake. A database leak exposes every user. Fix: hash with bcrypt or argon2 before saving. Always.

Mistake 2: Using a Fast Hash Like SHA-256

SHA-256 is fast, so brute-forcing a list of hashes is fast. Fix: use a slow password hash (bcrypt, argon2, scrypt). They are slow on purpose.

Mistake 3: No Salt

Without a salt, two users with the same password get the same hash. Attackers can use rainbow tables. Fix: bcrypt and argon2 handle salting automatically. Do not roll your own.

Mistake 4: Low Salt Rounds

bcrypt with 5 rounds is too fast. An attacker can brute-force quickly. Fix: use 10 or 12 rounds. 10 is fine for most apps; 12 for high-security.

Mistake 5: Hashing Sync in Request Handlers

bcrypt.hashSync blocks the event loop. Other requests stall. Fix: use the async API (await bcrypt.hash). Use async/await in a pre('save') hook.

Mistake 6: Returning passwordHash in Responses

You send the hash to the client. Even hashed, it should not leave the server. Fix: mark passwordHash with select: false. Use a serializer that omits it.

Mistake 7: Logging Passwords or Hashes

A debug log accidentally contains the password. Fix: never log passwords or hashes. Filter them from logs. Use a logger that redacts known sensitive fields.

Mistake 8: Rehashing on Every Save

You hash in pre('save') without checking if the password changed. Profile updates rehash the existing hash, breaking login. Fix: check this.isModified('passwordHash') before hashing.

Mistake 9: Not Handling Updates

findByIdAndUpdate bypasses pre('save'). The new password is stored unhashed. Fix: hash in a pre('findOneAndUpdate') hook, or hash in the controller before calling update.

Mistake 10: Using the Same Hash for Different Purposes

You use the password hash for an API token too. Fix: use different hashes for different purposes. JWT for tokens, bcrypt for passwords. Never mix.

The Takeaway

Common password hashing mistakes: plain text, fast hashes (SHA-256), no salt, low rounds, sync hashing, returning hashes, logging hashes, rehashing on every save, not handling updates, and mixing purposes. Fix them on day one.