Password hashing with Werkzeug in Flask

Introduction

Password hashing helps keep user passwords safe by turning them into secret codes that are hard to guess or reverse.

When you want to store user passwords safely in a database.

When you need to check if a user's entered password matches the stored one without saving the actual password.

When building login or registration features in a web app.

When you want to protect user data from hackers if your database is leaked.

Syntax

Flask

from werkzeug.security import generate_password_hash, check_password_hash

hashed_password = generate_password_hash('your_password')
is_correct = check_password_hash(hashed_password, 'user_input_password')

generate_password_hash creates a safe hashed version of the password.

check_password_hash compares a hashed password with a user input to verify if they match.

Examples

Creates a hashed password from the string 'mypassword'.

Flask

hashed = generate_password_hash('mypassword')

Checks if the hashed password matches the original password.

Flask

check_password_hash(hashed, 'mypassword')  # returns True

Returns False because the password does not match.

Flask

check_password_hash(hashed, 'wrongpassword')  # returns False

Sample Program

This program hashes a password, then checks if a user input matches it. It prints the hashed password and whether the input is correct.

Flask

from werkzeug.security import generate_password_hash, check_password_hash

# Create a hashed password
hashed_pw = generate_password_hash('secret123')
print(f'Hashed password: {hashed_pw}')

# Simulate user input
user_input = 'secret123'

# Check if user input matches the hashed password
if check_password_hash(hashed_pw, user_input):
    print('Password is correct!')
else:
    print('Password is incorrect!')

Important Notes

Never store plain text passwords; always hash them before saving.

Werkzeug uses strong hashing algorithms by default, so you don't need to choose one manually.

Hashed passwords include a random salt, so the same password will have different hashes each time.

Summary

Password hashing keeps passwords safe by turning them into secret codes.

Use generate_password_hash to hash passwords and check_password_hash to verify them.

Always hash passwords before storing to protect user data.

Practice

1. What is the main purpose of using generate_password_hash in a Flask app?

easy

A. To generate random passwords for users

B. To check if a password matches the stored hash

C. To encrypt the entire user database

D. To securely convert a plain password into a hashed version before storing

Solution

1. Step 1: Understand the role of generate_password_hash

   This function takes a plain password and creates a hashed version that is safe to store.

2. Step 2: Differentiate from other functions

   check_password_hash is used to verify passwords, not generate them. Encryption of the whole database or generating random passwords are unrelated.

3. Final Answer:

   To securely convert a plain password into a hashed version before storing -> Option D

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hash passwords before storing to keep them safe [OK]

Common Mistakes:

• Confusing hashing with encryption
• Using check_password_hash to create hashes
• Thinking hashing generates random passwords

2. Which of the following is the correct way to import the password hashing functions from Werkzeug?

easy

A. from flask import generate_password_hash, check_password_hash

B. import werkzeug.hash as wh

C. from werkzeug.security import generate_password_hash, check_password_hash

D. import werkzeug.security.hash_password

Solution

1. Step 1: Recall the correct import path

   The password hashing functions are in werkzeug.security, so import them directly from there.

2. Step 2: Check each option

   from werkzeug.security import generate_password_hash, check_password_hash correctly imports both functions. import werkzeug.hash as wh uses a wrong module alias. from flask import generate_password_hash, check_password_hash tries to import from Flask, which is incorrect. import werkzeug.security.hash_password uses a non-existent import path.

3. Final Answer:

   from werkzeug.security import generate_password_hash, check_password_hash -> Option C

4. Quick Check:

   Correct import path = from werkzeug.security import generate_password_hash, check_password_hash [OK]

Hint: Import from werkzeug.security for hashing functions [OK]

Common Mistakes:

• Importing from flask instead of werkzeug
• Using wrong module names or aliases
• Trying to import non-existent functions

3. What will be the output of this code snippet?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
print(check_password_hash(hashed, 'mypassword'))
print(check_password_hash(hashed, 'wrongpass'))

medium

A. True\nFalse

B. False\nTrue

C. True\nTrue

D. False\nFalse

Solution

1. Step 1: Understand the hashing and checking process

   The password 'mypassword' is hashed. Then check_password_hash verifies if the given password matches the hash.

2. Step 2: Evaluate the two checks

   Checking with 'mypassword' returns True because it matches. Checking with 'wrongpass' returns False because it does not match.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Correct password = True, wrong password = False [OK]

Hint: Check returns True only if password matches hash exactly [OK]

Common Mistakes:

• Assuming check_password_hash returns the hash
• Mixing up True and False results
• Not understanding that hashes are one-way

4. Identify the error in this code snippet:

from werkzeug.security import generate_password_hash, check_password_hash
password = 'secret'
hash = generate_password_hash(password)
if check_password_hash(password, hash):
    print('Password matches')

medium

A. Password variable should be hashed twice

B. Arguments to check_password_hash are reversed

C. Missing import for check_password_hash

D. generate_password_hash should be called with bytes, not string

Solution

1. Step 1: Review the function signature of check_password_hash

   The correct order is check_password_hash(hashed_password, plain_password).

2. Step 2: Identify the argument order in the code

   The code passes password first and hash second, which is reversed and causes a logic error.

3. Final Answer:

   Arguments to check_password_hash are reversed -> Option B

4. Quick Check:

   check_password_hash(hashed, password) correct order [OK]

Hint: Pass hashed first, then plain password to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Thinking generate_password_hash needs bytes input
• Forgetting to import check_password_hash

5. You want to store user passwords securely and verify them during login. Which approach correctly uses Werkzeug functions in a Flask app?

hard

A. Hash passwords with generate_password_hash before storing, then verify with check_password_hash

B. Store plain passwords, then use check_password_hash on them

C. Encrypt passwords with generate_password_hash and decrypt during login

D. Store hashed passwords and compare them directly to plain passwords

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to protect user data from leaks.

2. Step 2: Use correct verification method

   Use check_password_hash to verify the plain password against the stored hash during login.

3. Step 3: Eliminate incorrect options

   Storing plain passwords is insecure. Hashing is one-way, so decrypting is impossible. Direct comparison of hash and plain password fails.

4. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash -> Option A

5. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Always hash before storing; verify with check_password_hash [OK]

Common Mistakes:

• Storing plain passwords
• Trying to decrypt hashes
• Comparing hash and plain password directly