Implementasi Bcrypt dan SHA-256 untuk Keamanan Autentikasi dan Verifikasi Pengguna Aplikasi Persediaan Barang
- Usman Usman Universitas Dipa Makassar, Sulawesi Selatan, Indonesia
-
Muh. Syahlan Natsir
*
Universitas Dipa Makassar, Sulawesi Selatan,
Indonesia
(*) Corresponding Author
Abstract
User authentication and verification security are essential aspects of web-based applications, as insecure credential storage may increase the risk of password disclosure and unauthorized access to the system. This study aims to implement and evaluate a user security mechanism in an inventory application by employing bcrypt for password protection, SHA-256 for verification token generation, and One-Time Password (OTP) for email ownership verification. The study adopted a software engineering approach consisting of security requirement identification, security mechanism design, implementation, and functional and performance testing. Bcrypt was implemented with a cost factor of 12 in the application, while its performance was evaluated using cost factors of 8, 10, 12, and 14 by measuring password hashing and verification times. SHA-256 was employed to generate a verification token from a combination of the user's email address, time information, and a unique identifier, whereas a six-digit OTP was delivered via email and validated against the value temporarily stored in the session. The functional testing results demonstrated that the system successfully authenticated verified accounts with correct passwords while rejecting incorrect passwords, unverified accounts, and invalid OTPs. Increasing the bcrypt cost factor resulted in higher computational time. The hashing times for cost factors 8, 10, 12, and 14 were 45.2 ms, 98.7 ms, 385.4 ms, and 1,542.8 ms, respectively, while the corresponding verification times were 43.8 ms, 96.3 ms, 382.1 ms, and 1,538.6 ms. In the email verification process, OTP generation required 2.1 ms, email delivery required 847.3 ms, and OTP validation required 1.8 ms. These results indicate that bcrypt, SHA-256, and OTP can be integrated as distinct yet complementary security mechanisms, while the selection of an appropriate bcrypt cost factor should consider the trade-off between security requirements and system processing time.
Downloads
References
Batubara, T. P., Efendi, S., & Nababan, E. B. (2021). Analysis performance BCRYPT algorithm to improve password security from brute force. Journal of Physics: Conference Series, 1811, 012129. https://doi.org/10.1088/1742-6596/1811/1/012129
Febrian, D., Christian, Y., Sutisna, A. W., Budiarto, G., Syukur, M., Ramadhan, X. H., Kuntoro, A. Y., & Fahlapi, R. (2023). Implementation of Bcrypt algorithm on website-based hashing generator using Laravel framework. Journal of Information System, Informatics and Computing, 7(2), 199–212. https://doi.org/10.52362/jisicom.v7i2.1130
Fedorchenko, V., Yeroshenko, O., Shmatko, O., Kolomiitsev, O., & Omarov, M. (2024). Password hashing methods and algorithms on the .NET platform. Advanced Information Systems, 8(4), 82–92. https://doi.org/10.20998/2522-9052.2024.4.11
Giffary, R. S., & Ramadhani, E. (2022). Implementasi Bcrypt dengan SHA-256 pada password pengguna aplikasi Golek Kost. Jurnal Sistem Komputer dan Informatika (JSON), 3(4), 543–546. https://doi.org/10.30865/json.v3i4.4285
Hartono, J. F., Suharjo, I. C., & Sidharta, S. (2025). Comparison of Argon2id and Bcrypt with default parameters in performance and security aspect for secure authentication. Procedia Computer Science, 269, 411–420. https://doi.org/10.1016/j.procs.2025.08.293
Jannah, N., Istianah, L., & Tahir, M. (2026). Implementasi cryptography based multilayer authentication pada sistem login berbasis web menggunakan Bcrypt hashing dan One Time Password (OTP). Jurnal Sistem Cerdas dan Rekayasa, 8(1). https://doi.org/10.61293/jscr.v8i1.946
Khasanah, N. I., Mujianto, A. H., & Widoyoningrum, S. (2023). Peningkatan sistem keamanan One Time Password (OTP) pada token aplikasi Computer Based Test (CBT) menggunakan algoritma SHA-256. Inovate: Jurnal Ilmiah Inovasi Teknologi Informasi, 8(1), 18–27. https://doi.org/10.33752/inovate.v8i1.5084
Listiawan, I., Zaidir, Z., Winardi, S., & Diqi, M. (2024). Optimising Bcrypt parameters: Finding the optimal number of rounds for enhanced security and performance. Compiler, 13(1), 1–10. https://doi.org/10.28989/compiler.v13i1.2111
Nur, J. (2023). Implementation of Bcrypt algorithm for SIPAPEDA website security at BAPPEDA Office, Buton Regency with One Time Password method. JEAT: Journal of Electrical and Automation Technology, 2(2), 90–96. https://doi.org/10.61844/jeat.v2i2.724
Piyawanno, K., & Nuntawisuttiwong, T. (2024). Hashing algorithm for protecting credential information against channel interception and server-side data leakage. In 2024 28th International Computer Science and Engineering Conference (ICSEC). IEEE. https://doi.org/10.1109/ICSEC62781.2024.10770628
Ramdani, F. C., Rahmatulloh, A., & Shofa, R. N. (2023). Implementation of JSON Web Token on authentication with HMAC SHA-256 algorithm. Sistemasi: Jurnal Sistem Informasi, 12(1), 194–205. https://doi.org/10.32520/stmsi.v12i1.2450
Saran, A. N. (2024). On time-memory trade-offs for password hashing schemes. Frontiers in Computer Science, 6, 1368362. https://doi.org/10.3389/fcomp.2024.1368362
Alkhwaja, I., Albugami, M., Alkhwaja, A., Alghamdi, M., Abahussain, H., Alfawaz, F., Almurayh, A., & Min-Allah, N. (2023). Password cracking with brute force algorithm and dictionary attack using parallel programming. Applied Sciences, 13(10), 5979. https://doi.org/10.3390/app13105979
Aji, N. D., Sujaka, T. T., Husain, Asroni, O., & Latif, K. A. (2025). Analisis dan implementasi algoritma Bcrypt dengan Affine Cipher untuk pengamanan password pada aplikasi web. Cyber Security dan Forensik Digital, 8(1), 1–9. https://doi.org/10.14421/csecurity.2025.8.1.5076
Almahmudi, F. B., Rosidin, R., Sulaeman, D. A., & Sukarsa, S. (2025). Implementation of BCRYPT algorithm in website-based complaint information system for user password security. Jurnal Jembatan Efektivitas Ilmu dan Akhlak Ahlussunah Wal Jama'ah, 6(1), 187–198. https://doi.org/10.52188/jeas.v6i1.1110
Rana, M., Pandey, A., Mishra, A., & Kandu, V. (2023). Enhancing data security: A comprehensive study on the efficacy of JSON Web Token (JWT) and HMAC SHA-256 algorithm for web application security. International Journal on Recent and Innovation Trends in Computing and Communication, 11(9), 4409–4416. https://doi.org/10.17762/ijritcc.v11i9.9930
Saputra, M. G. D., & Akbi, D. R. (2026). Perbandingan Bcrypt, Argon2, dan PBKDF2 pada keamanan SIMPEG berbasis web. Jurnal Informatika: Jurnal Pengembangan IT, 11(2). https://doi.org/10.30591/jpit.v11i2.10280
Uminingsih, Ichsanudin, M. N., Yusuf, M., & Suraya. (2022). Perpustakaan Dengan Metode Black Box Testing Bagi Pemula. STORAGE – Jurnal Ilmiah Teknik Dan Ilmu Komputer, 1(2), 1–8. https://doi.org/10.55123/storage.v1i2.270
Bila bermanfaat silahkan share artikel ini
Berikan Komentar Anda terhadap artikel Implementasi Bcrypt dan SHA-256 untuk Keamanan Autentikasi dan Verifikasi Pengguna Aplikasi Persediaan Barang
Copyright (c) 2026 Usman Usman, Muh. Syahlan Natsir
This work is licensed under a Creative Commons Attribution 4.0 International License.
Authors who publish with this journal agree to the following terms:
- Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under Creative Commons Attribution 4.0 International License that allows others to share the work with an acknowledgment of the work's authorship and initial publication in this journal.
- Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgment of its initial publication in this journal.
- Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work (Refer to The Effect of Open Access).
