Why are you explicitly pulling bcrypt in? This is usually implicitly required by Devise and helps minimize the number of gems in the Gemfile. This is a subject opinion without an objective black/white consequence.