diff --git a/package-lock.json b/package-lock.json
index 4fbe704..4b1f548 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -4245,6 +4245,16 @@
         "@babel/types": "^7.28.2"
       }
     },
+    "node_modules/@types/bcrypt": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@types/bcrypt/-/bcrypt-6.0.0.tgz",
+      "integrity": "sha512-/oJGukuH3D2+D+3H4JWLaAsJ/ji86dhRidzZ/Od7H/i8g+aCmvkeCc6Ni/f9uxGLSQVCRZkX2/lqEFG2BvWtlQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
     "node_modules/@types/body-parser": {
       "version": "1.19.6",
       "resolved": "https://registry.npmjs.org/@types/body-parser/-/body-parser-1.19.6.tgz",
@@ -4823,6 +4833,29 @@
         "node": ">=6.0.0"
       }
     },
+    "node_modules/bcrypt": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/bcrypt/-/bcrypt-6.0.0.tgz",
+      "integrity": "sha512-cU8v/EGSrnH+HnxV2z0J7/blxH8gq7Xh2JFT6Aroax7UohdmiJJlxApMxtKfuI7z68NvvVcmR78k2LbT6efhRg==",
+      "hasInstallScript": true,
+      "license": "MIT",
+      "dependencies": {
+        "node-addon-api": "^8.3.0",
+        "node-gyp-build": "^4.8.4"
+      },
+      "engines": {
+        "node": ">= 18"
+      }
+    },
+    "node_modules/bcrypt/node_modules/node-addon-api": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.9.0.tgz",
+      "integrity": "sha512-ekZMeaaIzSQTSpr7X2X3iJM7lTzgnx8ahAG9pJfT/7+14mlEM8ZYQ9cgCDvSSRbReFK0oHli3WrZdCiRsgAT9Q==",
+      "license": "MIT",
+      "engines": {
+        "node": "^18 || ^20 || >= 21"
+      }
+    },
     "node_modules/beasties": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/beasties/-/beasties-0.4.1.tgz",
@@ -8173,6 +8206,17 @@
         "node": "^20.17.0 || >=22.9.0"
       }
     },
+    "node_modules/node-gyp-build": {
+      "version": "4.8.4",
+      "resolved": "https://registry.npmjs.org/node-gyp-build/-/node-gyp-build-4.8.4.tgz",
+      "integrity": "sha512-LA4ZjwlnUblHVgq0oBF3Jl/6h/Nvs5fzBLwdEF4nuxnFdsfajde4WfxtJr3CaiH+F6ewcIB/q4jQ4UzPyid+CQ==",
+      "license": "MIT",
+      "bin": {
+        "node-gyp-build": "bin.js",
+        "node-gyp-build-optional": "optional.js",
+        "node-gyp-build-test": "build-test.js"
+      }
+    },
     "node_modules/node-gyp-build-optional-packages": {
       "version": "5.2.2",
       "resolved": "https://registry.npmjs.org/node-gyp-build-optional-packages/-/node-gyp-build-optional-packages-5.2.2.tgz",
@@ -11284,6 +11328,7 @@
       "version": "1.0.0",
       "license": "GPL-3.0",
       "dependencies": {
+        "bcrypt": "^6.0.0",
         "cookie-parser": "^1.4.7",
         "cors": "^2.8.6",
         "dotenv": "^17.3.1",
@@ -11297,6 +11342,7 @@
         "winston": "^3.19.0"
       },
       "devDependencies": {
+        "@types/bcrypt": "^6.0.0",
         "@types/cookie-parser": "^1.4.10",
         "@types/cors": "^2.8.19",
         "@types/express": "^5.0.6",
@@ -11310,12 +11356,6 @@
         "ts-node": "^10.9.2",
         "typescript": "^5.9.3"
       }
-    },
-    "shared": {
-      "version": "1.0.0",
-      "extraneous": true,
-      "license": "GPL-3.0",
-      "devDependencies": {}
     }
   }
 }
diff --git a/package.json b/package.json
index bf335eb..67a593d 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,8 @@
     "test": "echo \"Error: no test specified\" && exit 1",
     "server": "npm run dev --workspace=server",
     "client": "npm start --prefix client",
-    "dev": "concurrently \"npm run server\" \"npm run client\""
+    "dev": "concurrently \"npm run server\" \"npm run client\"",
+    "teardown": "npm run teardown --workspace=server"
   },
   "workspaces": [
     "client",
diff --git a/server/package.json b/server/package.json
index 76431c3..5e443bd 100644
--- a/server/package.json
+++ b/server/package.json
@@ -15,9 +15,12 @@
     "setup": "docker compose up -d",
     "teardown": "docker compose down",
     "keygen": "ts-node src/scripts/keygen.ts",
+    "hash": "ts-node src/scripts/hash.ts",
+    "verify": "ts-node src/scripts/verify.ts",
     "dev": "npm run setup && npm run node; npm run teardown"
   },
   "dependencies": {
+    "bcrypt": "^6.0.0",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.6",
     "dotenv": "^17.3.1",
@@ -31,6 +34,7 @@
     "winston": "^3.19.0"
   },
   "devDependencies": {
+    "@types/bcrypt": "^6.0.0",
     "@types/cookie-parser": "^1.4.10",
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.6",
diff --git a/server/src/routes/auth.ts b/server/src/routes/auth.ts
index d764e02..ec50640 100644
--- a/server/src/routes/auth.ts
+++ b/server/src/routes/auth.ts
@@ -1,3 +1,4 @@
+import { compare } from 'bcrypt';
 import express from 'express';
 import { logger } from '../util/logging';
 import User from '../model/user';
@@ -12,9 +13,7 @@ router.post('/login', async (req, res) => {
     const data : LoginRequest = req.body;
     const user = await User.findOne({where: { userID: data.username}});
     if (!user) return res.status(401).json(new Msg('Invalid credentials'));
-    const isMatch = (data.password == user.password);
-    //TODO hash passwords
-    //const isMatch = await bcrypt.compare(password, user.passwordHash);
+    const isMatch = await compare(data.password, user.password);
     if (!isMatch) return res.status(401).json(new Msg('Invalid credentials'));
 
     // successfully authenticated
diff --git a/server/src/scripts/hash.ts b/server/src/scripts/hash.ts
new file mode 100644
index 0000000..78e410a
--- /dev/null
+++ b/server/src/scripts/hash.ts
@@ -0,0 +1,5 @@
+import {hash} from  'bcrypt';
+let pass = process.argv[2];
+hash(pass, 10, function(err, hash) {
+    console.log(hash);
+});
\ No newline at end of file
diff --git a/server/src/scripts/verify.ts b/server/src/scripts/verify.ts
new file mode 100644
index 0000000..5a3fdc9
--- /dev/null
+++ b/server/src/scripts/verify.ts
@@ -0,0 +1,6 @@
+import {compare} from  'bcrypt';
+let pass = process.argv[2];
+let hash = process.argv[3];
+compare(pass,hash, function(err, result){
+    console.log(result);
+});