Npm bcrypt and meteor npm bcrypt madness


Somewhere between version 1.3 and 1.4 of meteor I had to install a specific version of bcrypt because of some accounts-ui issue - I’ve since lost track of that github issue so I’m having trouble going back over what I’ve changed.

Now I keep getting this error:

W20160830-11:50:40.866(-4)? (STDERR) Note: you are using a pure-JavaScript implementation of bcrypt.
W20160830-11:50:40.868(-4)? (STDERR) While this implementation will work correctly, it is known to be
W20160830-11:50:40.868(-4)? (STDERR) approximately three times slower than the native implementation.
W20160830-11:50:40.868(-4)? (STDERR) In order to use the native implementation instead, run
W20160830-11:50:40.869(-4)? (STDERR)          
W20160830-11:50:40.869(-4)? (STDERR)   meteor npm install --save bcrypt
W20160830-11:50:40.869(-4)? (STDERR)          
W20160830-11:50:40.870(-4)? (STDERR) in the root directory of your application.

I’ve run meteor npm install --save bcrypt multiple times and the error will go away, but just until I do something with npm install [somepackage] --save - every time I do, this error comes back.

What’s the deal, anyone else experiencing this?

Does anyone know how to stop this madness?


I have the same issue. Don’t know of a fix


Did you try installing that bcrypt version globally?


How would I install the “Meteor” version globally? Meteor complains about the pure javascript version being slow and wants to install their super neat speedy one…


Sorry, with expected I mean you install it just with npm install -g. But I reviewed some installs here and that shouldn’t be needed.

Do you have this in your package.json?:

  "dependencies": {
    "bcrypt": "^0.8.7"


Do you still have the bcrypt package in your .meteor/packages file?


Yes, no idea whether it’s needed, I have in package and versions file:


Will put that on our todo to see whether it’s a duplicate or actually necessary.


Try removing the bcrypt package from the packages file


my setup works, I am not @autoschematic :slight_smile:


I am experiencing the same issue.


Hi everyone again,

So, to answer your question @henribeck

I’ve tried pretty much everything and it’s still giving me this error on and off.

I’ve removed bcrypt npm remove bcrypt --save (and looked at the packages.json file to double check that "bcrypt": "^0.8.7" is not there) and then ran the meteor npm install --save bcrypt - and then it places this:

"dependencies": {
  "bcrypt": "^0.8.7",

in my packages.json

I really wish I could track down what that github issue was talking about concerning this - it was a fix related to the accounts-ui or account-core or something… I ran that fix, and It was related to installing bcrypt. I’ve checked to see if bcrypt is installed globally, and it doesn’t seam to be.

Any thoughts?

Edit: I mean, obviously this isn’t a breaking thing - it’s just annoying to see the pink error :stuck_out_tongue:


No, i mean remove bcrypt .meteor/packages file, not from you’re package.json file :slight_smile:


I fixed this error with:
ls node_modules | grep bcrypt
rm -rf node_modules/bcrypt-pbkdf
meteor npm install --save bcrypt


@gemmi & @henribeck, thanks so much - If it comes up again, I’ll try what you did there Gemmi, along with making sure bcrypt is completely uninstalled from both package files and report back.


So accounts-password depends on npm-bcrypt which I think is the culprit here. It adds npm-bcrypt@0.9.1 to my meteor/versions files.


I’ve used meteor npm rebuild after that I didn’t see the notice again.
Mention here:


meteor npm rebuild not working for me…


See my answer here:


Did you get this working?


This is driving me nuts… I tried the above remedies, none of which fixed it.

Now it complains every time I run meteor, even after issuing the command to install bcrypt

npm rebuild didn’t help. Trying to remove node-bcrypt didn’t work, Meteor just put it back in there.

Can someone please provide a fix for this?

In fact, while I’m on my soapbox, Meteor will tell me that an npm module is missing and may cause problems. Why can’t it just install the package, or at least prompt me to do so? A common problem among the dev team is caused by this, after doing a “git pull” an “npm install” is necessary to install any newly introduced packages. This is a time waster that (I think) could be fixed quite easily. After all, if the .meteor/packages file has a new entry, Meteor will fetch that and install it. Can’t it do the same with npm modules?