title: node Bcrypt compare always returns success
body: <p>always when I try to compare between the newUser.password with profile.password it gives me success even if I put a wrong password</p>
  <p>and here is my code</p>
  <pre><code>    const bcrypt = require('bcrypt')
  
  const router = require('express').Router()
  // const jwt = require('jsonwebtoken')
  let User = require('../models/user.model')
  
   router.route('/login').post(async(req, res) =&gt; {
      var newUser = {};
      newUser.email = req.body.email;
  
      newUser.password = req.body.password;
      console.log(newUser.password)
       User.findOne({ email: newUser.email })
        .then(profile =&gt; {
          if (!profile) {
            res.send(&quot;User not exist&quot;);
  </code></pre>
  <p>here it will compare for me the hashed pass with the pass that the client give</p>
  <pre><code>        }else if(bcrypt.compare(newUser.password, profile.password)){
              res.send(&quot;success&quot;);
  </code></pre>
  <p>here will stop</p>
  <pre><code>        }
          else if((newUser.password !== profile.password)){
            res.send(&quot;wrong&quot;);
            }
        })
        .catch(err =&gt; res.status(400).json('Erorr: ' + err))
          
  })
  
  router.route('/add').post(async(req, res) =&gt; {
    const hashedPassword = await bcrypt.hash(req.body.password, 10)
  
      const username = req.body.username
      const email = req.body.email
      const password = hashedPassword
      const firstname = req.body.firstname
      const lastname = req.body.lastname
  
      const newUser = new User({username, email, password, firstname, lastname})
      
      // const accessToken = jwt.sign(password, process.env.ACCESS_TOKEN_SECRET)
      // res.json({ accessToken: accessToken })
  
      newUser.save()
      .then(() =&gt; res.json('User added!'))
      .catch(err =&gt; res.status(400).json('Erorr: ' + err))
  })
  
  // function authToken(req, res, next){
  //     const authHeader = req.headers['authorization']
  //     const token = authHeader &amp;&amp; authHeader.split(' ')[1]
  //     if (token == null ) return res.sendStatus(401)
  
  //     jwt.verify(token, process.env.ACCESS_TOKEN_SECRET, (err, password) =&gt; {
  //         if (err) return res.sendStatus(403)
  //         req.password = password
  //         next()
  //     })
  // }
  
  module.exports = router
  </code></pre>