5 Best Ways to Hash Passwords in Python with bcrypt

by

💡 Problem Formulation: In the world of web development and data security, storing user passwords as plain text is a critical vulnerability. It’s essential to hash passwords before storing them, to ensure that an acquired database does not directly compromise user accounts. This article shows how to use bcrypt, a robust password hashing function, to securely hash passwords in Python. The input is a plain text password, and the output is a hashed and salted version of that password, suitable for secure storage.

Method 1: Basic Hashing with bcrypt

Using the bcrypt library in Python, we can hash a password with added salt that bcrypt generates automatically. Salting is a security measure that adds additional random data to the input of a hash function. This method will hash and salt a password in a way that is secure and makes each hash unique even for identical passwords.

Here’s an example:

import bcrypt

password = b"supersecretpassword"
hashed = bcrypt.hashpw(password, bcrypt.gensalt())
print(hashed)

Output: b’$2b$12$…’

This code snippet imports the bcrypt library, defines a password in bytes, and hashes it using bcrypt.hashpw(), along with a generated salt using bcrypt.gensalt(). The hashed password is then printed, indicating a successful hash operation.

Method 2: Setting the Complexity of the Salt

The complexity of the hashing process can be increased by specifying the number of rounds the hashing algorithm will execute. This makes the hashing process slower, and thus, more resistant against brute force attacks. Bcrypt allows you to adjust the complexity by changing the work factor, providing an extra layer of security.

Here’s an example:

import bcrypt

password = b"supersecretpassword"
salt = bcrypt.gensalt(rounds=14)
hashed = bcrypt.hashpw(password, salt)
print(hashed)

Output: b’$2b$14$…’

In this example, we increase the security of the hashing process by setting the number of rounds to 14 using bcrypt.gensalt(rounds=14). This generates a more complex salt, which, when used to hash the password, provides better protection against attacks.

Method 3: Checking a Password Against a Hash

Validating a user’s password against the stored hash is crucial in authentication processes. Bcrypt offers a simple and secure way to compare a plaintext password to its hashed counterpart, verifying the validity of user credentials without ever storing or comparing plaintext passwords.

Here’s an example:

import bcrypt

hashed = b'$2b$12$...'
password = b"userenteredpassword"

if bcrypt.checkpw(password, hashed):
    print("Login successful.")
else:
    print("Invalid credentials.")

Output: Login successful. or Invalid credentials.

By using bcrypt.checkpw(), we verify if the provided plaintext password matches the previously hashed and stored password. The output communicates whether the user’s login attempt is successful based on the validity of the credentials provided.

Method 4: Hashing with a Pre-defined Salt

Although it is recommended to let bcrypt generate a salt for each password, certain situations may require using a predefined salt. This can be useful for consistency in specific test cases or when integrating into a system that uses a common salt.

Here’s an example:

import bcrypt

password = b"supersecretpassword"
salt = b'$2b$12$abcdefghijklmnopqrstuv'

hashed = bcrypt.hashpw(password, salt)
print(hashed)

Output: b’$2b$12$…’

Here, we use a predefined salt and pass it to the bcrypt.hashpw() function to hash the password. While using a predefined salt can be useful in tests, it is not recommended for production deployments due to reduced security.

Bonus One-Liner Method 5: Inline Hash and Salt

For quick hashing needs, you can perform password hashing with an inline one-liner using bcrypt. This method combines steps into a compact, easily readable line of code.

Here’s an example:

import bcrypt
print(bcrypt.hashpw(b"supersecretpassword", bcrypt.gensalt(12)))

Output: b’$2b$12$…’

This one-liner code snippet provides a quick and concise way to hash a password with a specified number of rounds for the salt directly in the call to bcrypt.hashpw().

Summary/Discussion

  • Method 1: Basic Hashing with bcrypt. Straightforward and secure default method for password hashing. Limited customization of security parameters. Ideal for most common use cases.
  • Method 2: Setting the Complexity of the Salt. Offers enhanced security through custom work factor. Might increase processing time, which could be a concern for systems with high authentication traffic.
  • Method 3: Checking a Password Against a Hash. Essential for user authentication, providing a high degree of security since the plaintext password is never stored or compared.
  • Method 4: Hashing with a Pre-defined Salt. Useful for testing environments but generally less secure due to static salting. Not recommended for production systems.
  • Method 5: Inline Hash and Salt. Convenient for quick hashing needs, but limits readability and maintainability for complex codebases.