Password hashing with Werkzeug in Flask - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ Predict Output

intermediate

Output of password hash check

What will be the output of this Flask code snippet using Werkzeug's password hashing?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

hashed = generate_password_hash('mypassword')
result = check_password_hash(hashed, 'mypassword')
print(result)

A SyntaxError

B False

C TypeError

D True

💡 Hint

Check if the password matches the hash using check_password_hash.

The generate_password_hash creates a hashed password string. The check_password_hash returns True if the password matches the hash.

❓ Predict Output

intermediate

Result of checking wrong password

What will be the output of this code when checking a wrong password?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

hashed = generate_password_hash('secret123')
result = check_password_hash(hashed, 'wrongpass')
print(result)

A False

B True

C ValueError

D None

💡 Hint

Check_password_hash returns False if password does not match.

The password 'wrongpass' does not match the hashed 'secret123', so check_password_hash returns False.

📝 Syntax

advanced

Identify the syntax error in password hashing code

Which option contains a syntax error when using Werkzeug's password hashing functions?

Flask

from werkzeug.security import generate_password_hash

hashed = generate_password_hash('pass123')

A hashed = generate_password_hash('pass123', method='sha256')

B hashed = generate_password_hash('pass123')

C hashed = generate_password_hash('pass123', method=sha256)

D hashed = generate_password_hash('pass123', salt_length=8)

💡 Hint

Check if method argument is passed as a string or variable.

The method parameter must be a string like 'sha256'. Passing sha256 without quotes causes a NameError or syntax error.

❓ component_behavior

advanced

Behavior of password hash with different salt lengths

What is the effect of changing the salt_length parameter in generate_password_hash?

Flask

from werkzeug.security import generate_password_hash

hash1 = generate_password_hash('mypassword', salt_length=8)
hash2 = generate_password_hash('mypassword', salt_length=16)
print(hash1 == hash2)

A False, hashes differ because salt length changes the hash

B True, hashes are always the same regardless of salt length

C TypeError, salt_length is not a valid parameter

D ValueError, salt_length must be 12

💡 Hint

Salt length affects the randomness added to the hash.

Changing salt_length changes the salt used, so hashes differ even for the same password.

🔧 Debug

expert

Debugging password hash verification failure

A developer uses this code but password verification always fails. What is the cause?

Flask

from werkzeug.security import generate_password_hash, check_password_hash

password = 'admin123'
hash_pw = generate_password_hash(password)

# Later in code
result = check_password_hash(password, hash_pw)
print(result)

A password variable is not a string

B check_password_hash arguments are reversed; first should be hash, second password

C check_password_hash requires bytes, not strings

D generate_password_hash returns None, causing failure

💡 Hint

Check the order of arguments in check_password_hash.

The check_password_hash function expects the hashed password first, then the plain password. Reversing them causes verification to fail.

Practice

1. What is the main purpose of using generate_password_hash in a Flask app?

easy

A. To generate random passwords for users

B. To check if a password matches the stored hash

C. To encrypt the entire user database

D. To securely convert a plain password into a hashed version before storing

Solution

1. Step 1: Understand the role of generate_password_hash

   This function takes a plain password and creates a hashed version that is safe to store.

2. Step 2: Differentiate from other functions

   check_password_hash is used to verify passwords, not generate them. Encryption of the whole database or generating random passwords are unrelated.

3. Final Answer:

   To securely convert a plain password into a hashed version before storing -> Option D

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hash passwords before storing to keep them safe [OK]

Common Mistakes:

• Confusing hashing with encryption
• Using check_password_hash to create hashes
• Thinking hashing generates random passwords

2. Which of the following is the correct way to import the password hashing functions from Werkzeug?

easy

A. from flask import generate_password_hash, check_password_hash

B. import werkzeug.hash as wh

C. from werkzeug.security import generate_password_hash, check_password_hash

D. import werkzeug.security.hash_password

Solution

1. Step 1: Recall the correct import path

   The password hashing functions are in werkzeug.security, so import them directly from there.

2. Step 2: Check each option

   from werkzeug.security import generate_password_hash, check_password_hash correctly imports both functions. import werkzeug.hash as wh uses a wrong module alias. from flask import generate_password_hash, check_password_hash tries to import from Flask, which is incorrect. import werkzeug.security.hash_password uses a non-existent import path.

3. Final Answer:

   from werkzeug.security import generate_password_hash, check_password_hash -> Option C

4. Quick Check:

   Correct import path = from werkzeug.security import generate_password_hash, check_password_hash [OK]

Hint: Import from werkzeug.security for hashing functions [OK]

Common Mistakes:

• Importing from flask instead of werkzeug
• Using wrong module names or aliases
• Trying to import non-existent functions

3. What will be the output of this code snippet?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
print(check_password_hash(hashed, 'mypassword'))
print(check_password_hash(hashed, 'wrongpass'))

medium

A. True\nFalse

B. False\nTrue

C. True\nTrue

D. False\nFalse

Solution

1. Step 1: Understand the hashing and checking process

   The password 'mypassword' is hashed. Then check_password_hash verifies if the given password matches the hash.

2. Step 2: Evaluate the two checks

   Checking with 'mypassword' returns True because it matches. Checking with 'wrongpass' returns False because it does not match.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Correct password = True, wrong password = False [OK]

Hint: Check returns True only if password matches hash exactly [OK]

Common Mistakes:

• Assuming check_password_hash returns the hash
• Mixing up True and False results
• Not understanding that hashes are one-way

4. Identify the error in this code snippet:

from werkzeug.security import generate_password_hash, check_password_hash
password = 'secret'
hash = generate_password_hash(password)
if check_password_hash(password, hash):
    print('Password matches')

medium

A. Password variable should be hashed twice

B. Arguments to check_password_hash are reversed

C. Missing import for check_password_hash

D. generate_password_hash should be called with bytes, not string

Solution

1. Step 1: Review the function signature of check_password_hash

   The correct order is check_password_hash(hashed_password, plain_password).

2. Step 2: Identify the argument order in the code

   The code passes password first and hash second, which is reversed and causes a logic error.

3. Final Answer:

   Arguments to check_password_hash are reversed -> Option B

4. Quick Check:

   check_password_hash(hashed, password) correct order [OK]

Hint: Pass hashed first, then plain password to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Thinking generate_password_hash needs bytes input
• Forgetting to import check_password_hash

5. You want to store user passwords securely and verify them during login. Which approach correctly uses Werkzeug functions in a Flask app?

hard

A. Hash passwords with generate_password_hash before storing, then verify with check_password_hash

B. Store plain passwords, then use check_password_hash on them

C. Encrypt passwords with generate_password_hash and decrypt during login

D. Store hashed passwords and compare them directly to plain passwords

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to protect user data from leaks.

2. Step 2: Use correct verification method

   Use check_password_hash to verify the plain password against the stored hash during login.

3. Step 3: Eliminate incorrect options

   Storing plain passwords is insecure. Hashing is one-way, so decrypting is impossible. Direct comparison of hash and plain password fails.

4. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash -> Option A

5. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Always hash before storing; verify with check_password_hash [OK]

Common Mistakes:

• Storing plain passwords
• Trying to decrypt hashes
• Comparing hash and plain password directly