diff --git a/pom.xml b/pom.xml
index 605e56d..e1179eb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -129,6 +129,13 @@
             <artifactId>spring-boot-starter-actuator</artifactId>
         </dependency>
 
+        <!-- jBCrypt (独立 BCrypt 实现，无 Spring Security 依赖) -->
+        <dependency>
+            <groupId>org.mindrot</groupId>
+            <artifactId>jbcrypt</artifactId>
+            <version>0.4</version>
+
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/src/main/java/com/guo/learningprogresstracker/service/impl/UserServiceImpl.java b/src/main/java/com/guo/learningprogresstracker/service/impl/UserServiceImpl.java
index 9baa745..0f2516b 100644
--- a/src/main/java/com/guo/learningprogresstracker/service/impl/UserServiceImpl.java
+++ b/src/main/java/com/guo/learningprogresstracker/service/impl/UserServiceImpl.java
@@ -7,6 +7,7 @@ import com.guo.learningprogresstracker.exception.AppException;
 import com.guo.learningprogresstracker.service.UserService;
 import com.guo.learningprogresstracker.mapper.UserMapper;
 import lombok.RequiredArgsConstructor;
+import org.mindrot.jbcrypt.BCrypt;
 import org.springframework.stereotype.Service;
 
 /**
@@ -23,12 +24,13 @@ public class UserServiceImpl extends ServiceImpl<UserMapper, UserEntity>
     public String authenticate(String username, String password) throws AppException {
 
         UserEntity userEntity = this.getOneOpt(Wrappers.<UserEntity>lambdaQuery()
-                .eq(UserEntity::getUserName, username)
-                .eq(UserEntity::getUserPassword, password)).orElseThrow(() -> new AppException("账号或密码错误！"));
-        return  userEntity.getId();
+                .eq(UserEntity::getUserName, username))
+                .orElseThrow(() -> new AppException("账号或密码错误！"));
+
+        if (!BCrypt.checkpw(password, userEntity.getUserPassword())) {
+            throw new AppException("账号或密码错误！");
+        }
+
+        return userEntity.getId();
     }
 }
-
-
-
-
diff --git a/src/main/resources/db/migration/V20260617_1__alter_user_password_length.sql b/src/main/resources/db/migration/V20260617_1__alter_user_password_length.sql
new file mode 100644
index 0000000..ecc8282
--- /dev/null
+++ b/src/main/resources/db/migration/V20260617_1__alter_user_password_length.sql
@@ -0,0 +1 @@
+ALTER TABLE `user` MODIFY COLUMN `user_password` varchar(60) NOT NULL COMMENT '账号密码(BCrypt哈希)';
diff --git a/src/test/java/com/guo/learningprogresstracker/utils/BCryptPasswordGeneratorTest.java b/src/test/java/com/guo/learningprogresstracker/utils/BCryptPasswordGeneratorTest.java
new file mode 100644
index 0000000..3f2d37a
--- /dev/null
+++ b/src/test/java/com/guo/learningprogresstracker/utils/BCryptPasswordGeneratorTest.java
@@ -0,0 +1,24 @@
+package com.guo.learningprogresstracker.utils;
+
+import org.junit.jupiter.api.Test;
+import org.mindrot.jbcrypt.BCrypt;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class BCryptPasswordGeneratorTest {
+
+    @Test
+    void generatePasswordHash() {
+        String password = System.getProperty("password", "admin");
+        int rounds = Integer.parseInt(System.getProperty("rounds", "10"));
+
+        String hash = BCrypt.hashpw(password, BCrypt.gensalt(rounds));
+
+        System.out.println("BCrypt hash:");
+        System.out.println(hash);
+        System.out.println("SQL:");
+        System.out.printf("UPDATE `user` SET `user_password` = '%s' WHERE `user_name` = 'admin';%n", hash);
+
+        assertTrue(BCrypt.checkpw(password, hash));
+    }
+}