Never plain text, pick an algorithm (bcrypt or argon2), use a salt, hash in a pre('save') hook, handle updates, mark with select: false, use a serializer, never log passwords, validate strength, rate limit login, use HTTPS, implement password reset, invalidate sessions on change, use httpOnly cookies, and notify users.
Never store plain text. Hash with bcrypt or argon2 before saving. No exceptions. Without this, every other step is wasted. This is the foundation.
After basic auth works and you have hashing in place. Reset depends on hashing the new password and sending emails. Implement it before launch so users can recover from forgotten passwords.
Bump a tokenVersion field on the user. The auth middleware checks that the JWT's tokenVersion matches the user's current one. After a change, old JWTs are rejected and the user must log in again.
Browse all our FAQs or reach out to our support team
Your learning library
Find your next course. Build something great.
