Hash a password with Node's crypto module and no dependency

You're storing user passwords and you know plain text is wrong, but installing bcrypt for a side project feels heavy.

IntermediateRead 6 minDoing: about 30 minutes7 steps

What you'll have at the end

A hash-and-verify pair built on crypto.scrypt, with the cost numbers and the salt packed into one string alongside the hash so a login check can rebuild the exact same key later.

Before you start

You need

A place in your signup and login code where you already have the plaintext password a user just typed, and a spot next to their other account fields to store one string.

Not covered

Argon2id, which current guidance ranks above scrypt, isn't part of every Node release the way scrypt is, so it takes a newer runtime or an outside package; this recipe sticks to what's already built in.

Leans on

7 steps

Where to go next

Move a slow calculation off the event loop with a worker thread

once login traffic is heavy enough that the shared background pool itself becomes the bottleneck, that recipe's dedicated worker thread is the deeper fix

Checked 25 Aug 2026

Part of the Node.js cookbook