Rack::Bacoo combines HTTP Basic Authentication with a session cookie so that you don't have to input username and password on each visit. The session cookie is encrypted (aes-256-gcm), and the password inside is hashed (bcrypt).