Stop storing password hashes. Here is a working WebAuthn / passkey implementation for Node.js that replaces passwords with biometric or device-bound credentials using the FIDO2 standard, with server-side validation, credential storage in Postgres, and a minimal client implementation.