SHA Is Not a Suitable Algorithm for Securing Passwords.

[bookercodes]

Here it looks like you are using SHA to hash passwords.

It is my understanding SHA is not a suitable algorithm for securing passwords.

• Source 1
• Source 2
• Source 3

According to OWASP (and indeed, many other security resources,) bcrypt or PBKDF2 should be used instead.

[mozfreddyb]

Argon2 would be a better candidate than bcrypt or PBKDF2.

[bookercodes]

@mozfreddyb,

Are you sure?

I cannot find any Node modules for Argon2, let alone a one that is tried and true like node.bcrypt.js.