Password hashing transforms a password into a one-way cryptographic representation before storage. Unlike plain text, the resulting hash is designed to be difficult to reverse, reducing exposure if someone accesses the database. section 8.3.2
A stored password
Instead of storing SomePassword123, an application stores a value such as H(SomePassword123) = g53jkdlgfee09ded8d33rr45t5y5y43f2eff. A database row can therefore keep a username and password_hash rather than the original password. section 8.3.2
A practical password workflow includes these steps:
- Hash a new password with bcrypt and store the resulting string in the password_hash field. section 8.3.2
- When authenticating, compare the supplied password with the stored hash rather than retrieving a plain-text password. section 8.7
- Check confirmation fields before creating an account, then report success or an existing-username error in the interface. section 8.3.2
from dataclasses import dataclass
import bcrypt
@dataclass
class User:
username: str
password_hash: str
@staticmethod
def hash_password(password):
return bcrypt.hashpw(password.encode(), bcrypt.gensalt()).decode()
def authenticate(self, password):
return bcrypt.checkpw(password.encode(), self.password_hash.encode())
The User dataclass keeps bcrypt hashing and authentication together, showing the minimal implementation pattern. section 8.3.2
