Package: bcrypt
bcryptAcceptable password hashing for your software and your servers (but you should
really use argon2id or scrypt)InstallationTo install bcrypt, simply:$pipinstallbcryptNote that bcrypt should build very easily on Linux provided you have a C
compiler and a Rust compiler (the minimum supported Rust version is 1.56.0).For Debian and Ubuntu, the following command will ensure that the required dependencies are installed:$sudoapt-getinstallbuild-essentialcargoFor Fedora and RHEL-derivatives, the following command will ensure that the required dependencies are installed:$sudoyuminstallgcccargoFor Alpine, the following command will ensure that the required dependencies are installed:$apkadd--updatemusl-devgcccargoAlternativesWhile bcrypt remains an acceptable choice for password storage, depending on your specific use case you may also want to consider using scrypt (either viastandard libraryorcryptography) or argon2id viaargon2_cffi.Changelog4.1.2Publish bothpy37andpy39wheels. This should resolve some errors
relating to initializing a module multiple times per process.4.1.1Fixed the type signature on thekdfmethod.Fixed packaging bug on Windows.Fixed incompatibility with passlib package detection assumptions.4.1.0Dropped support for Python 3.6.Bumped MSRV to 1.64. (Note: Rust 1.63 can be used by setting theBCRYPT_ALLOW_RUST_163environment variable)4.0.1We now build PyPymanylinuxwheels.Fixed a bug where passing an invalidsalttocheckpwcould result in
apyo3_runtime.PanicException. It now correctly raises aValueError.4.0.0bcryptis now implemented in Rust. Users building from source will need
to have a Rust compiler available. Nothing will change for users downloading
wheels.We no longer shipmanylinux2010wheels. Users should upgrade to the latestpipto ensure this doesn’t cause issues downloading wheels on their
platform. We now shipmanylinux_2_28wheels for users on new enough platforms.NULbytes are now allowed in inputs.3.2.2Fixed packaging ofpy.typedfiles in wheels so thatmypyworks.3.2.1Added support for compilation on z/OSThe next release ofbcryptwith be 4.0 and it will require Rust at
compile time, for users building from source. There will be no additional
requirement for users who are installing from wheels. Users on most
platforms will be able to obtain a wheel by making sure they have an up to
datepip. The minimum supported Rust version will be 1.56.0.This will be the final release for which we shipmanylinux2010wheels.
Going forward the minimum supported manylinux ABI for our wheels will bemanylinux2014. The vast majority of users will continue to receivemanylinuxwheels provided they have an up to datepip.3.2.0Added typehints for library functions.Dropped support for Python versions less than 3.6 (2.7, 3.4, 3.5).Shippedabi3Windows wheels (requires pip >= 20).3.1.7Set asetuptoolslower bound for PEP517 wheel building.We no longer distribute 32-bitmanylinux1wheels. Continuing to produce
them was a maintenance burden.3.1.6Added support for compilation on Haiku.3.1.5Added support for compilation on AIX.Dropped Python 2.6 and 3.3 support.Switched to usingabi3wheels for Python 3. If you are not getting a
wheel on a compatible platform please upgrade yourpipversion.3.1.4Fixed compilation with mingw and on illumos.3.1.3Fixed a compilation issue on Solaris.Added a warning when using too few rounds withkdf.3.1.2Fixed a compile issue affecting big endian platforms.Fixed invalid escape sequence warnings on Python 3.6.Fixed building in non-UTF8 environments on Python 2.3.1.1Resolved aUserWarningwhen used withcffi1.8.3.3.1.0Added support forcheckpw, a convenience method for verifying a password.Ensure that you get a$2y$hash when you input a$2y$salt.Fixed a regression where$2ahashes were vulnerable to a wraparound bug.Fixed compilation under Alpine Linux.3.0.0Switched the C backend to code obtained from the OpenBSD project rather than
openwall.Added support forbcrypt_pbkdfvia thekdffunction.2.0.0Added support for an adjustible prefix when callinggensalt.Switched to CFFI 1.0+UsagePassword HashingHashing and then later checking that a password matches the previous hashed
password is very simple:>>>importbcrypt>>>password=b"super secret password">>># Hash a password for the first time, with a randomly-generated salt>>>hashed=bcrypt.hashpw(password,bcrypt.gensalt())>>># Check that an unhashed password matches one that has previously been>>># hashed>>>ifbcrypt.checkpw(password,hashed):...print("It Matches!")...else:...print("It Does not Match :(")KDFAs of 3.0.0bcryptnow offers akdffunction which doesbcrypt_pbkdf.
This KDF is used in OpenSSH’s newer encrypted private key format.>>>importbcrypt>>>key=bcrypt.kdf(...password=b'password',...salt=b'salt',...desired_key_bytes=32,...rounds=100)Adjustable Work FactorOne of bcrypt’s features is an adjustable logarithmic work factor. To adjust
the work factor merely pass the desired number of rounds tobcrypt.gensalt(rounds=12)which defaults to 12):>>>importbcrypt>>>password=b"super secret password">>># Hash a password for the first time, with a certain number of rounds>>>hashed=bcrypt.hashpw(password,bcrypt.gensalt(14))>>># Check that a unhashed password matches one that has previously been>>>#   hashed>>>ifbcrypt.checkpw(password,hashed):...print("It Matches!")...else:...print("It Does not Match :(")Adjustable PrefixAnother one of bcrypt’s features is an adjustable prefix to let you define what
libraries you’ll remain compatible with. To adjust this, pass either2aor2b(the default) tobcrypt.gensalt(prefix=b"2b")as a bytes object.As of 3.0.0 the$2y$prefix is still supported inhashpwbut deprecated.Maximum Password LengthThe bcrypt algorithm only handles passwords up to 72 characters, any characters
beyond that are ignored. To work around this, a common approach is to hash a
password with a cryptographic hash (such assha256) and then base64
encode it to prevent NULL byte problems before hashing the result withbcrypt:>>>password=b"an incredibly long password"*10>>>hashed=bcrypt.hashpw(...base64.b64encode(hashlib.sha256(password).digest()),...bcrypt.gensalt()...)CompatibilityThis library should be compatible with py-bcrypt and it will run on Python
3.6+, and PyPy 3.C CodeThis library uses code from OpenBSD.Securitybcryptfollows thesame security policy as cryptography, if you
identify a vulnerability, we ask you to contact us privately.