# How to store passwords in the database

> Never store raw passwords in your database, store a hash instead. Learn how to hash and verify passwords in Node.js with bcrypt using hash() and compare().

Author: [Flavio Copes](https://flaviocopes.com/about/) | Published: 2020-05-22 | Topics: [Database](https://flaviocopes.com/tags/database/) | Canonical: https://flaviocopes.com/how-to-store-passwords/

You don't. You don't store passwords in the database. You store the **password hash**, a string generated from the password, but from which no one can go back to the original password value.

The password itself still needs to be strong before you hash it — I built a free [password generator](https://flaviocopes.com/tools/password-generator/) that creates random passwords and passphrases with entropy estimates.

Using Node, install `bcrypt`:

```sh
npm install bcrypt
```

Require it, and define the salt rounds value, we'll use it later:

```js
const bcrypt = require('bcrypt')

const saltRounds = 10
```

## Create a password hash

Create a password hash using:

```js
const hash = await bcrypt.hash('PASSWORD', saltRounds)
```

where `PASSWORD` is the actual password string.

If you prefer callbacks:

```js
bcrypt.hash('PASSWORD', saltRounds, (err, hash) => {
  
})
```

Then you can store the `hash` value in the database.

## Verify the password hash

To verify the password, compare it with the hash stored in the database using `bcrypt.compare()`:

```js
const result = await bcrypt.compare('PASSWORD', hash) 
//result is true or false
```

Using callbacks:

```js
bcrypt.compare('somePassword', hash, (err, result) => {
  //result is true or false
})
```