[pire111]

I created this code that can hash passwords. It has a secure salt and it uses key stretching, which is also used by bcrypt to make the password hashing process slower
do you think that this is secure?


[@ hasher]$ cat main.js
const crypto = require('crypto');

test = Date.now();

let password = 'hi';

const sha = (thing) => {
return crypto.createHash('sha256').update(thing).digest('hex');
};

const difficulty = 19; // 2 difficulty
const salt = crypto.randomBytes(16).toString('hex');

password = `${salt}:${password}`;

for (let i = 0; i < 2 difficulty; i++) {
password = sha(password);
};

const wCrypted = `${difficulty}:${salt}:${password}`;

testa = Date.now();
console.log(testa - test);
console.log(wCrypted);

[@ hasher]$ node main.js
728
19:28c1122a06cffad80cbda72b04912553:0375e3064e3cc900a5c5a9d56a7d683e77cb526db5dfcd325db112679fb8e8cf
[@ hasher]$

---

I know the code isn't written very well, but this is just a test script that I am creating; it's not the actual code