At the location https://github.com/node-red/node-red-admin/blob/master/lib/commands/hash.js#L27, the encryption of the salt with bcrypt.hashSync(password, 8) should have a loop count of at least 10 to ensure sufficient security.