I’ve seen some recommendations suggesting that you shouldn’t manually salt and hash a password before passing it into bcrypt, but I’m not sure why.
- Would manually salting interfere with bcrypt’s built-in salting mechanism?
- Could double hashing weaken security instead of strengthening it?
- Is there any scenario where adding an extra layer of hashing before bcrypt is beneficial?
I want to ensure I’m implementing bcrypt correctly without introducing unnecessary complexity or vulnerabilities.