Cryptography Basics

Cryptography underpins almost every security control: HTTPS, password storage, and secure messaging all depend on it. You don't need to implement algorithms yourself, but you do need to know which tool fits which job.

Hashing vs. encryption

These are often confused, but solve different problems:

Never store passwords in plain text, and never encrypt them either, always hash them with a slow, salted algorithm designed for passwords, like bcrypt:

import bcrypt from 'bcryptjs';

const passwordHash = await bcrypt.hash(plainTextPassword, 10); // 10 = cost factor
const matches = await bcrypt.compare(attemptedPassword, passwordHash);

bcrypt is deliberately slow and includes a random salt per password, so two identical passwords produce different hashes, and brute-forcing many hashes at once can't be sped up with a precomputed table (a "rainbow table").

Symmetric vs. asymmetric encryption

• Symmetric: the same key encrypts and decrypts (AES). Fast, but both parties need to already share the key securely.
• Asymmetric: a public key encrypts, only the matching private key can decrypt (RSA). Slower, but solves the key-sharing problem, you can publish your public key freely.

TLS/HTTPS

HTTPS uses both: an asymmetric handshake to securely agree on a shared secret, then fast symmetric encryption for the actual data transfer. This is why the browser padlock icon means the connection is encrypted and the server's identity was verified by a certificate, but it says nothing about whether the site itself is trustworthy.