Password hashing with bcrypt in FastAPI - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of using bcrypt for password hashing?

Bcrypt securely hashes passwords to protect them from being easily read or cracked if the database is compromised. It adds salt and uses a slow hashing algorithm to make attacks harder.

beginner

In FastAPI, which Python library is commonly used to implement bcrypt password hashing?

The passlib library is commonly used with FastAPI to handle bcrypt hashing easily and securely.

beginner

What does the term 'salt' mean in password hashing with bcrypt?

A salt is a random value added to the password before hashing. It ensures that even if two users have the same password, their hashes will be different.

intermediate

How do you verify a password against a bcrypt hash in FastAPI?

You use the verify method from the hashing library (like passlib) to check if the plain password matches the stored bcrypt hash.

intermediate

Why is bcrypt considered better than simple hashing functions like MD5 or SHA1 for passwords?

Bcrypt is designed to be slow and includes salting, which makes it resistant to brute force and rainbow table attacks, unlike fast hashes like MD5 or SHA1.

What does bcrypt add to passwords before hashing to make them more secure?

A Pepper

B Salt

C Plain text

D Compression

Bcrypt adds a random salt to each password before hashing to ensure unique hashes.

Which Python library is commonly used with FastAPI for bcrypt hashing?

A sqlalchemy

B requests

C flask

D passlib

Passlib provides easy bcrypt hashing and verification functions.

Why is bcrypt hashing slower than MD5 or SHA1?

A To make brute force attacks harder

B Because it uses more memory

C To save CPU resources

D Because it compresses data

Bcrypt is intentionally slow to make guessing passwords by brute force much harder.

How do you check if a user's password matches the stored bcrypt hash in FastAPI?

A Use the verify method from passlib

B Compare plain text passwords

C Use SQL queries

D Hash the password with MD5

The verify method safely compares the plain password with the stored bcrypt hash.

What happens if two users have the same password but bcrypt is used with salt?

A Passwords get stored in plain text

B Their hashes will be the same

C Their hashes will be different

D Passwords get rejected

Salt ensures that even identical passwords produce different hashes.

Explain how bcrypt protects passwords and why it is preferred over simple hashing methods.

Think about what makes bcrypt hashes different and safer.

Describe the steps to hash and verify a password using bcrypt in a FastAPI application.

Consider the flow from user input to password check.