JavaScript: storing passwords with scrypt and a salt
Passwords must be stored so that a leaked database does not reveal them. Use a deliberately slow, salted password hashing function. The salt is random and stored beside the hash, so equal passwords get different hashes and precomputed tables are useless.
JavaScript
const crypto = require("node:crypto");
const salt = crypto.randomBytes(16);
const stored = crypto.scryptSync("correct horse", salt, 32);
const good = crypto.scryptSync("correct horse", salt, 32);
const bad = crypto.scryptSync("wrong guess", salt, 32);
console.log("hash length: " + stored.length + " bytes");
console.log("right password: " + crypto.timingSafeEqual(stored, good));
console.log("wrong password: " + crypto.timingSafeEqual(stored, bad));