diff --git a/Gemfile b/Gemfile
index b060714..fb8c546 100644
--- a/Gemfile
+++ b/Gemfile
@@ -34,7 +34,7 @@ gem "jbuilder"
 # gem "kredis"
 
 # Use Active Model has_secure_password [https://guides.rubyonrails.org/active_model_basics.html#securepassword]
-# gem "bcrypt", "~> 3.1.7"
+gem "bcrypt", "~> 3.1.7"
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem "tzinfo-data", platforms: %i[ mingw mswin x64_mingw jruby ]
diff --git a/Gemfile.lock b/Gemfile.lock
index e1b3208..b148e08 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -68,6 +68,7 @@ GEM
       tzinfo (~> 2.0)
     addressable (2.8.4)
       public_suffix (>= 2.0.2, < 6.0)
+    bcrypt (3.1.19)
     bindex (0.8.1)
     bootsnap (1.16.0)
       msgpack (~> 1.2)
@@ -219,6 +220,7 @@ PLATFORMS
   x86_64-linux
 
 DEPENDENCIES
+  bcrypt (~> 3.1.7)
   bootsnap
   capybara
   debug
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 8e0086e..cfca408 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -4,11 +4,12 @@ class SessionsController < ApplicationController
 
   def create
     user = User.find_by username: params[:username]
-    if user.nil?
-      redirect_to signin_path, notice: "User #{params[:username]} does not exist!"
-    else
+
+    if user && user.authenticate(params[:password])
       session[:user_id] = user.id if user
-      redirect_to user
+      redirect_to user_path user, notice: "Welcome back :)"
+    else
+      redirect_to signin_path, notice: "Incorrect username or password"
     end
   end
 
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 71322bd..a3bb6ab 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -26,7 +26,7 @@ class UsersController < ApplicationController
 
     respond_to do |format|
       if @user.save
-        format.html { redirect_to user_url(@user), notice: "User was successfully created." }
+        format.html { redirect_to signin_path, notice: "User was successfully created." }
         format.json { render :show, status: :created, location: @user }
       else
         format.html { render :new, status: :unprocessable_entity }
@@ -67,6 +67,6 @@ class UsersController < ApplicationController
 
   # Only allow a list of trusted parameters through.
   def user_params
-    params.require(:user).permit(:username)
+    params.require(:user).permit(:username, :password, :password_confirmation)
   end
 end
diff --git a/app/models/user.rb b/app/models/user.rb
index 1dc9d5d..4b9c322 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -1,10 +1,21 @@
 class User < ApplicationRecord
   include RatingAverage
 
+  has_secure_password
+
   validates :username, uniqueness: true, length: { minimum: 3, maximum: 30 }
+  validates :password, length: { minimum: 3 }
+  validate :has_proper_characters_in_password
 
   has_many :ratings
   has_many :beers, through: :ratings
   has_many :memberships, dependent: :destroy
   has_many :beer_clubs, through: :memberships
+
+  def has_proper_characters_in_password
+    regex = "(?=.*[[:upper:]])(?=.*[0-9])"
+    if not password.match(regex)
+      errors.add :password, "doesn't contain uppercase letter and a number"
+    end
+  end
 end
diff --git a/app/views/sessions/new.html.erb b/app/views/sessions/new.html.erb
index a69aae7..4bf317d 100644
--- a/app/views/sessions/new.html.erb
+++ b/app/views/sessions/new.html.erb
@@ -1,8 +1,17 @@
-<p style="color: red"><%= notice %></p>
-
 <h1>Sign in</h1>
 
+<p style="color: red"><%= notice %></p>
+
 <%= form_with url: session_path, method: :post do |form| %>
-  <%= form.text_field :username %>
+  <div>
+    <%= form.label :username, style: "display: block" %>
+    <%= form.text_field :username %>
+  </div>
+
+  <div>
+    <%= form.label :password, style: "display: block" %>
+    <%= form.password_field :password %>
+  </div>
+
   <%= form.submit "Log in" %>
 <% end %>
diff --git a/app/views/users/_form.html.erb b/app/views/users/_form.html.erb
index eb063d9..852b294 100644
--- a/app/views/users/_form.html.erb
+++ b/app/views/users/_form.html.erb
@@ -16,6 +16,15 @@
     <%= form.text_field :username %>
   </div>
 
+  <div>
+    <%= form.label :password, style: "display: block" %>
+    <%= form.password_field :password %>
+  </div>
+  <div>
+    <%= form.label :password_confirmation, style: "display: block" %>
+    <%= form.password_field :password_confirmation %>
+  </div>
+
   <div>
     <%= form.submit %>
   </div>
diff --git a/db/migrate/20230810180821_add_password_digest_to_user.rb b/db/migrate/20230810180821_add_password_digest_to_user.rb
new file mode 100644
index 0000000..c14c8a7
--- /dev/null
+++ b/db/migrate/20230810180821_add_password_digest_to_user.rb
@@ -0,0 +1,5 @@
+class AddPasswordDigestToUser < ActiveRecord::Migration[7.0]
+  def change
+    add_column :users, :password_digest, :string
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index 73ca6df..1478daf 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.0].define(version: 2023_08_10_162557) do
+ActiveRecord::Schema[7.0].define(version: 2023_08_10_180821) do
   create_table "beerclubs", force: :cascade do |t|
     t.string "name"
     t.integer "founded"
@@ -53,6 +53,7 @@ ActiveRecord::Schema[7.0].define(version: 2023_08_10_162557) do
     t.string "username"
     t.datetime "created_at", null: false
     t.datetime "updated_at", null: false
+    t.string "password_digest"
   end
 
 end