Add a pepper to a hash: as a string or a buffer, and should I calculate a hash of a peppered plain text? I'm using a bcryptjs to generate a computationally slow hash function for storing passwords:



BCRYPT.hash(plainTextPassword, HASH_ROUNDS_NUM);


Now I want to add a pepper before a hash is calculated:



BCRYPT.hash(pepperedPassword, HASH_ROUNDS_NUM);


where pepperedPassword = plainTextPassword + PEPPER;

Questions:


Should I represent a PEPPER as a string or as a buffer?
To calculate a pepperedPassword I can either just concatenate two values:




pepperedPassword = concate(plainTextPassword, PEPPER);


or concatenate them and then calculate a fast hash of it (in addition to  bcrypt):



const concatPassPepp = concate(plainTextPassword, PEPPER);

const hashedConcatPassPepp  = crypto.createHash("SHA3-512").update(concatPassPepp, "utf8").digest("base64");


Is it a useful idea to calculate a fast hash of password-pepper concatenation before sending it to bcrypt? Which scenario should I prefer?

Both questions are asked from security and performance point of view.
To calculate a pepperedPassword I can either just concatenate two values:
  


Bcrypt limits the password. This means that if the password is too long (longer than 56 bytes), it will simply be truncated. If you just attach the pepper to the password, there is a high risk that this will happen. Then the pepper's security gain could even be lost without being noticed. 

Use HMAC or even a hash function to combine a password and a pepper. 


  
  Should I represent a PEPPER as a string or as a buffer?
  


That's up to you, but if you use HMAC or a hash function, it's obvious not to use a string.