Devise: encrypted_password field name scares the crap out of me

[joshjordan]

I know (now) that there is a plan to deprecate the use of encrypted_password as a field name, but I only learned that because I panicked after installing Devise in a new Rails app. Then, I spent some time digging through the code to verify that Devise is using BCrypt by default and git blameing old commits to figure out why the field has the name it does.

I bet (hope!) I am not the only one who sees this field and wonders in horror about what Devise is doing under the hood, and others may not be as successful as myself in tracking down the answer. Would a pull request be accepted that described the reason & clarifies that hashing is actually happening?

[georgeguimaraes]

@joshjordan that's a nice idea. What do you have in mind about how to document the reasoning?

[joshjordan]

I would probably add a note to the readme after the installation migration that gives the message "You may notice that we're using a password field entitled encrypted_password. Don't panic! We are, of course, hahsing passwords using Bcrypt (by default). This field is named this way for legacy reasons and will be deprecated, and later changed, in future versions. See for more details".

Something along those lines. Thoughts?

[lucasmazza]

@joshjordan :+1: for a README.md update for this.

[evertonts]

@joshjordan Any news on this issue?

[svperfecta]

We used devise for a new project today, this scared the crap out of us too until we did some digging. This is worth a breaking change IMHO.