What is the encryption used by Strapi in the password fields?

sunnyson · April 13, 2021, 9:14am

We use bcrypt with autogenerated salt and hash.

Admin service:

strapi/strapi/blob/86e0cf0f55d58e714a67cf4daee2e59e39974dd9/packages/strapi-admin/services/auth.js#L12

    
      
          
          
const bcrypt = require('bcryptjs');
          const _ = require('lodash');
          const { getAbsoluteAdminUrl } = require('strapi-utils');
          
          
/**
           * hashes a password
           * @param {string} password - password to hash
           * @returns {string} hashed password
           */
          const hashPassword = password => bcrypt.hash(password, 10);
          
          
/**
           * Validate a password
           * @param {string} password
           * @param {string} hash
           * @returns {boolean} is the password valid
           */
          const validatePassword = (password, hash) => bcrypt.compare(password, hash);
          
          
/**

Users-permissions:

github.com

strapi/strapi/blob/86e0cf0f55d58e714a67cf4daee2e59e39974dd9/packages/strapi-plugin-users-permissions/services/User.js#L87-L100

    
      
          hashPassword(user = {}) {
            return new Promise((resolve, reject) => {
              if (!user.password || this.isHashed(user.password)) {
                resolve(null);
              } else {
                bcrypt.hash(`${user.password}`, 10, (err, hash) => {
                  if (err) {
                    return reject(err);
                  }
                  resolve(hash);
                });
              }
            });
          },