Hashing Passwords with bcrypt.js

A bcrypt hash is always 60 characters long, whether the password behind it has 8 characters or 50. Hash the same password twice and you get two different 60-character strings, and yet both of them verify the password correctly. Those two facts explain most of how bcrypt protects stored passwords, and this lesson shows where each one comes from.

Why passwords are hashed, not encrypted

A hash function turns any input into a fixed-size output, and it cannot be run backward. Encryption is different, because anyone with the key can decrypt the data and recover the original