# Using Crypto::Bcrypt::Password for authentication

**URL:** <https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743>\
**Category:** Offtopic\
**Created:** [May 7, 2019, 8:34pm UTC](https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743 "2019-05-07T20:34:04Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![curious2learn](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@curious2learn](https://forum.crystal-lang.org/u/curious2learn)\
**Post date:** [May 7, 2019, 8:34pm UTC](https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743/1 "2019-05-07T20:34:04Z")

</div>

I am looking for some pointers on how to use `Crypto::Bcrypt::Password` for authentication in my web application.

When a user signs up, I store the hashed password of the user in Postgres in a text format. The hash is created using (assume that password is `abcd`):

```
 Crypto::Bcrypt::Password("abcd")

```

Now when the user signs in I am trying to use the following function (currently I have added `puts` statements for debugging:

```
def is_email_password_valid(email : String, password : String)
    begin
    puts "Inputs: #{email}, #{password}"
    emaildb, passdb = @conn.query_one("select email, password from users
                            where email = $1",
                            email,
                            as: {String, String})
    rescue ex
        puts ex.message
    else
        puts "#{emaildb}, #{passdb}"
        if password == Crypto::Bcrypt::Password.new(passdb)
            puts "Result: valid email and password"
        else
            puts "Invalid creds!"
        end
    end
end

```

Even if I enter the correct password, the above is giving my `Invalid creds!` as output. I am not sure why? Any help about the data format to use and how to compare the two passwords (the plain text entered by the user, and the hashed one in the database) would be appreciated.

Thank you.

---

<div class="post-metadata">

**Author:** ![asterite](https://yyz2.discourse-cdn.com/flex036/user_avatar/forum.crystal-lang.org/asterite/32/60_2.png) [@asterite](https://forum.crystal-lang.org/u/asterite)\
**Post date:** [May 7, 2019, 8:50pm UTC](https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743/2 "2019-05-07T20:50:53Z")

</div>

Try:

```auto
if Crypto::Bcrypt::Password.new(passdb) == password

```

it seems `==` is defined on `Crypto::Bcrypt::Password` but not on `String`… which makes sense to me, I think using `==` for this purpose is not a good API design. It should probably be a `matches?` method on `Password` or something like that.

If you feel this can be improved, please open an issue in our GitHub repository. Thank you!

---

<div class="post-metadata">

**Author:** ![curious2learn](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@curious2learn](https://forum.crystal-lang.org/u/curious2learn)\
**Post date:** [May 7, 2019, 9:09pm UTC](https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743/3 "2019-05-07T21:09:35Z")

</div>

Thank you @asterite. That worked! I think you are right. `matches?` would be better since intuitively, most people would expect `==` to be commutative.

---

<div class="post-metadata">

**Author:** ![nsuchy](https://avatars.discourse-cdn.com/v4/letter/n/c0e974/32.png) [@nsuchy](https://forum.crystal-lang.org/u/nsuchy)\
**Post date:** [May 8, 2019, 2:03am UTC](https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743/4 "2019-05-08T02:03:57Z")

</div>

Amber has a good model template implementing bcrypt for authentication. It might be good idea to look over and compare with what you have.

See: [https://github.com/amberframework/amber/blob/6c2889bafa57d44d1951a2dec60a519af2fad87a/src/amber/cli/templates/auth/granite/src/models/{{name}}.cr.ecr](https://github.com/amberframework/amber/blob/6c2889bafa57d44d1951a2dec60a519af2fad87a/src/amber/cli/templates/auth/granite/src/models/%7B%7Bname%7D%7D.cr.ecr)

---

<div class="post-metadata">

**Author:** ![curious2learn](https://avatars.discourse-cdn.com/v4/letter/c/5daacb/32.png) [@curious2learn](https://forum.crystal-lang.org/u/curious2learn)\
**Post date:** [May 9, 2019, 2:19pm UTC](https://forum.crystal-lang.org/t/using-crypto-password-for-authentication/743/5 "2019-05-09T14:19:42Z")

</div>

Thank you, @nsuchy.