Bcrypt Password Verification in Python

Introduction

Passwords are normally used to secure the accounts of users within websites or applications. As a result, it is very crucial to handle the passwords securely. In case the passwords are stored using less secure ways, hackers can very easily steal them.

Methods such as MD5 or SHA are not secure for the storage of passwords. However, bcrypt is employed in place of them since it is more secure. This article explains bcrypt in simple words, how it works, and how it is used in Python.

What Is Bcrypt?

bcrypt stands as a unique module that encrypts passwords prior to storage in a database.

Bcrypt stores a hash of the password, instead of saving real password.

Because bcrypt is designed to run slowly, this is actually desirable from the perspective of security. A hacker may gain access to their database but would never be able to guess their true passwords anytime soon.

Why Bcrypt Is Better Than Simple Hashing

Simple hashing algorithms:

• Are very fast
• Is easy to break using modern computers

bcrypt is better because:

• It adds additional random data to the password
• Repeats the hashing process many times
• It makes password cracking slow and difficult
• It protects against common attacks like rainbow tables

What Is Salting?

Salting: Adding a random value to the password before hashing it.

Example: Password: 123456

• Salt: x9@#
• Result: 123456x9@#

This ensures:

• Same passwords do not have the same hash
• Hackers cannot use pre made password lists

bcrypt has the ability to handle salting automatically, and salting does not need to be handled manually by the developer.

What Is Key Stretching?

Key stretching means hashing password many times instead of once.

Get AjayPieris’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Why this important:

• Makes hashing process slow
• Slows down hackers trying millions of passwords

bcrypt uses a cost factor to control how slow hashing should be.

How Bcrypt Works in Python

Step 1: Install bcrypt

pip install bcrypt

Step 2: Hash a Password

import bcrypt

password = "Password123"

password_bytes = password.encode('utf-8')

hashed_password = bcrypt.hashpw(password_bytes, bcrypt.gensalt())

print(hashed_password)

What happens here:

• The password is transformed into bytes
• bcrypt creates a random salt
• The password is hashed and made secure

Step 3: Check the Password During Login

login_password = "Password123"

login_password_bytes = login_password.encode('utf-8')

if bcrypt.checkpw(login_password_bytes, hashed_password):
    print("Login successful")
else:
    print("Wrong password")

Explanation:

• bcrypt hashes login password again
• It compares it with stored hash
• If both match, login is allowed

Common Mistakes to Avoid

• Do not store passwords in plaintext form
• Don’t use MD5 or SHA for password hashing
• Do not roll your own salt
• Don’t compare passwords manually
• Avoid very low cost factor
• Never show passwords in logs or error messages

Conclusion

bcrypt certainly represents one of the safest methods for storing passwords in a Python application. It works by masking the password, adding randomness to it, which makes it extremely difficult to hack. With the help of bcrypt, developers can protect user passwords in an application.