bcryptcompareSyncpassword

Bcrypt compare refers to a set of functions in bcrypt libraries that verify a plaintext password against a stored bcrypt hash. Bcrypt hashes encode the version, cost factor, salt, and hash value in a single string, enabling secure verification without exposing the original password.

The compare operation works by taking the candidate password and the stored hash, extracting the salt and cost factor from the hash, rehashing the candidate with the same parameters, and performing a constant-time comparison to determine if they match. This constant-time comparison helps protect against timing side-channel attacks.

Typical usage varies by language and library but generally includes asynchronous and synchronous forms. In JavaScript, for example, one might call an asynchronous form like compare(candidatePassword, hash, callback) or a synchronous form like compareSync(candidatePassword, hash). Some libraries also provide promise-based interfaces. The function returns a boolean indicating whether the candidate password corresponds to the stored hash.

Security considerations include relying on the library’s proper implementation of constant-time comparison and ensuring the cost factor is appropriately high to deter brute-force attacks. The hash string stored in the database must be retrieved and used as the basis for comparison; the candidate password is never stored or transmitted in plain form beyond the moment of verification.

Common pitfalls include attempting to manually rehash without the embedded salt and cost factor or bypassing the library’s compare function. Using bcrypt compare correctly helps maintain secure authentication without exposing credentials.