René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Replace bcrypt with bcryptjs for better cross-platform compatibility","articleBody":"## Problem\n\nJavaScriptSolidServer currently uses `bcrypt` as the primary password hashing library, with `bcryptjs` as a fallback. However, `bcrypt` is a native C++ module that requires compilation, which causes installation failures on several platforms:\n\n### Platforms Affected\n- ✅ **Termux/Android** - Fails with `gyp: Undefined variable android_ndk_path`\n- ✅ **Windows** - Common compilation errors with node-gyp\n- ✅ **ARM devices** - Various build issues\n- ✅ **Restricted environments** - No build tools available\n\n### Current Behavior\nWhen users try to install JavaScriptSolidServer (or wrappers like jspod/fastpod) on these platforms:\n\n```\ngyp ERR! configure error \ngyp ERR! stack Error: `gyp` failed with exit code: 1\nnpm ERR! code 1\n```\n\nThis completely blocks installation, even though `bcryptjs` is already in the dependencies.\n\n## Proposed Solution\n\n**Switch to bcryptjs as the primary/only password hashing library.**\n\n### Why This Makes Sense\n\n1. **Minimal Performance Impact**\n   - bcrypt (C++): ~100ms per hash\n   - bcryptjs (JS): ~130ms per hash\n   - **Difference: 30ms** - only during login/registration (rare operations)\n\n2. **Better User Experience**\n   - No compilation errors\n   - Works everywhere Node.js runs\n   - Faster npm install (no build step)\n   - Same security guarantees\n\n3. **Real-World Usage**\n   - Password hashing happens maybe 1-10 times per day per user\n   - File operations happen thousands of times per day\n   - The 30ms difference is completely negligible\n\n4. **Already a Dependency**\n   - bcryptjs is already in package.json\n   - No new dependencies needed\n   - Just remove bcrypt\n\n### Security\n\nBoth libraries implement the same bcrypt algorithm with the same security properties:\n- ✅ Salt generation\n- ✅ Configurable work factor\n- ✅ Resistance to timing attacks\n- ✅ Industry-standard algorithm\n\nThe only difference is implementation language (C++ vs JavaScript).\n\n## Testing\n\nTested on:\n- ✅ Termux/Android (ARM64, Android 15) - **Currently fails with bcrypt**\n- ✅ Linux (works with both)\n- ✅ Expected to fix Windows issues as well\n\n## Implementation\n\nChange from:\n```json\n\"dependencies\": {\n  \"bcrypt\": \"^6.0.0\",\n  \"bcryptjs\": \"^3.0.3\"\n}\n```\n\nTo:\n```json\n\"dependencies\": {\n  \"bcryptjs\": \"^3.0.3\"\n}\n```\n\nAnd update all `require('bcrypt')` to `require('bcryptjs')`.\n\n## Impact\n\nThis would enable:\n- 📱 Running Solid pods on Android/Termux\n- 💻 Easier installation on Windows\n- 🌍 Better cross-platform support overall\n- ⚡ Faster installation (no compilation)\n\nWith virtually zero downside (30ms during infrequent auth operations).\n\n---\n\n**Use Case:** Trying to run `npx fastpod` on Termux fails due to bcrypt compilation. This blocks the entire \"just works\" philosophy of having a zero-config Solid server.","author":{"url":"https://github.com/melvincarvalho","@type":"Person","name":"melvincarvalho"},"datePublished":"2026-01-16T12:03:57.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/90/JavaScriptSolidServer/issues/90"}