userSchema.pre('save', async function (next) {

  //only run this function if password wa actually modified

  if (!this.isModified('password')) return next();

  //hash password with bcryptjs

  this.password = await bcrypt.hash(this.password, 12);

  //remove passwordConfirm before saving to database

  this.passwordConfirm = undefined;

});

​