Password Hashing with Python's Passlib
Passlib turns plaintext passwords into secure, salted hashes that are safe to store. Use it in any Python app with user accounts to handle logins. The footgun: never compare hashes directly; always use the `.verify()` method to prevent timing attacks.
WHY IT EXISTS: Storing user passwords in plaintext is a massive security risk. If your database is breached, all user credentials are stolen. Hashing converts passwords into a one-way, non-reversible format, but doing it correctly—with unique salts and modern algorithms—is complex. Passlib exists to provide a simple, secure, and standardized way to handle this in Python.
THE MENTAL MODEL: Think of Passlib as a specialized vault manager for passwords. You give it a plaintext password to store, and it gives you back a "receipt" (the hash string). This receipt contains everything needed to later verify the password—the algorithm used, the salt, and the hash itself—but doesn't contain the original password. To check a login attempt, you give the manager the attempted password and the original receipt, and it tells you if they match.
HOW IT WORKS: When you call a hash function like pbkdf2_sha256.hash(password), Passlib performs several steps. First, it generates a cryptographically secure random salt. Second, it combines the password and the salt. Third, it repeatedly applies a slow, computationally expensive hashing algorithm to this combination. The final output is a single string containing the algorithm name, the work factor (cost), the salt, and the resulting hash, all encoded together. The .verify(password, hash_string) method works by extracting the salt and parameters from the hash string and re-running the hash function on the provided password to see if the results match.
WHEN TO USE IT: Use Passlib whenever your Python application needs to store and verify user passwords. It's ideal for web backends (FastAPI, Flask, Django), command-line tools with user accounts, or any system that requires authentication. It simplifies using modern, strong hashing algorithms like Argon2, bcrypt, or PBKDF2.
WHEN NOT TO USE IT: Do not use Passlib for general-purpose hashing where speed is critical and cryptographic security is not the primary goal (e.g., checksums, hash tables). Its algorithms are intentionally slow to frustrate brute-force attacks on passwords. Also, it's for password hashing, not encryption; you cannot recover the original password from the hash.
ONE CANONICAL EXAMPLE: To create and verify a password hash using a specific algorithm like PBKDF2-SHA256: from passlib.hash import pbkdf2_sha256 Generate a new salt and hash a password hash_string = pbkdf2_sha256.hash("toomanysecrets") hash_string now looks like 'pbkdf2-sha25629000$N2Y...fk' Verifying the password during login is_correct = pbkdf2_sha256.verify("toomanysecrets", hash_string) # Returns True is_wrong = pbkdf2_sha256.verify("joshua", hash_string) # Returns False
Read the original → passlib.readthedocs.io
Get five bites like this every day.
Tezvyn delivers a daily feed of 60-second tech bites with quizzes to lock in what you learn.