Why do I need to store the salt for generated hashes?
The hash returned by bcrypt.hashSync is more than the hash itself, it contains all parameters needed by bcrypt. You do not need to store anything else yourself, this information is everything bcrypt needs to hash and compare an incoming password.

The actual hash was computed by combining the password and salt, so no worries there. The structured data is there merely to make your life easier and only need a single object to store.

In your first example, the output is:

$2a$10$M6qZCSbwhXipdmMy7kQ4V.obtALLSAjZsMYD/oGDAo0i/fcSGrmn2

This breaks down into:


version information: 2a
the number of rounds to perform: 10
the salt: M6qZCSbwhXipdmMy7kQ4V.
the actual hash: obtALLSAjZsMYD/oGDAo0i/fcSGrmn2


You can see the details in the code