Password hashing with Werkzeug in Flask - Mini Project: Build & Apply

Password hashing with Werkzeug in Flask

📖 Scenario: You are building a simple Flask web app that needs to securely store user passwords. Instead of saving plain text passwords, you will use Werkzeug's password hashing utilities to protect user data.

🎯 Goal: Create a Flask app that hashes a user's password using Werkzeug's generate_password_hash function and then verifies it using check_password_hash.

📋 What You'll Learn

Create a Flask app instance

Import generate_password_hash and check_password_hash from werkzeug.security

Hash a plain text password using generate_password_hash

Verify the hashed password using check_password_hash

💡 Why This Matters

🌍 Real World

Web applications must never store plain text passwords. Using Werkzeug's hashing functions in Flask apps protects user data from leaks and hacks.

💼 Career

Understanding password hashing is essential for backend developers and security engineers working on user authentication systems.

1

Set up Flask app and import hashing functions

Create a Flask app by importing Flask from flask and instantiate it as app. Also import generate_password_hash and check_password_hash from werkzeug.security.

Flask

from flask import Flask
from werkzeug.security import generate_password_hash, check_password_hash

app = Flask(__name__)
# Your code here

Hint

Remember to import both generate_password_hash and check_password_hash from werkzeug.security.

2

Create a plain text password variable

Create a variable called plain_password and set it to the string 'MySecret123'.

Flask

from flask import Flask
from werkzeug.security import generate_password_hash, check_password_hash

app = Flask(__name__)

plain_password = 'MySecret123'
# Your code here

Hint

Assign the exact string 'MySecret123' to the variable plain_password.

3

Hash the plain text password

Create a variable called hashed_password and set it to the result of calling generate_password_hash with plain_password as the argument.

Flask

from flask import Flask
from werkzeug.security import generate_password_hash, check_password_hash

app = Flask(__name__)

plain_password = 'MySecret123'

hashed_password = generate_password_hash(plain_password)
# Your code here

Hint

Use generate_password_hash with plain_password to create the hashed password.

4

Verify the hashed password

Create a variable called is_correct and set it to the result of calling check_password_hash with hashed_password and plain_password as arguments.

Flask

from flask import Flask
from werkzeug.security import generate_password_hash, check_password_hash

app = Flask(__name__)

plain_password = 'MySecret123'

hashed_password = generate_password_hash(plain_password)

is_correct = check_password_hash(hashed_password, plain_password)
# Your code here

Hint

Use check_password_hash with hashed_password and plain_password to verify the password.

Practice

1. What is the main purpose of using generate_password_hash in a Flask app?

easy

A. To generate random passwords for users

B. To check if a password matches the stored hash

C. To encrypt the entire user database

D. To securely convert a plain password into a hashed version before storing

Solution

1. Step 1: Understand the role of generate_password_hash

   This function takes a plain password and creates a hashed version that is safe to store.

2. Step 2: Differentiate from other functions

   check_password_hash is used to verify passwords, not generate them. Encryption of the whole database or generating random passwords are unrelated.

3. Final Answer:

   To securely convert a plain password into a hashed version before storing -> Option D

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hash passwords before storing to keep them safe [OK]

Common Mistakes:

• Confusing hashing with encryption
• Using check_password_hash to create hashes
• Thinking hashing generates random passwords

2. Which of the following is the correct way to import the password hashing functions from Werkzeug?

easy

A. from flask import generate_password_hash, check_password_hash

B. import werkzeug.hash as wh

C. from werkzeug.security import generate_password_hash, check_password_hash

D. import werkzeug.security.hash_password

Solution

1. Step 1: Recall the correct import path

   The password hashing functions are in werkzeug.security, so import them directly from there.

2. Step 2: Check each option

   from werkzeug.security import generate_password_hash, check_password_hash correctly imports both functions. import werkzeug.hash as wh uses a wrong module alias. from flask import generate_password_hash, check_password_hash tries to import from Flask, which is incorrect. import werkzeug.security.hash_password uses a non-existent import path.

3. Final Answer:

   from werkzeug.security import generate_password_hash, check_password_hash -> Option C

4. Quick Check:

   Correct import path = from werkzeug.security import generate_password_hash, check_password_hash [OK]

Hint: Import from werkzeug.security for hashing functions [OK]

Common Mistakes:

• Importing from flask instead of werkzeug
• Using wrong module names or aliases
• Trying to import non-existent functions

3. What will be the output of this code snippet?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
print(check_password_hash(hashed, 'mypassword'))
print(check_password_hash(hashed, 'wrongpass'))

medium

A. True\nFalse

B. False\nTrue

C. True\nTrue

D. False\nFalse

Solution

1. Step 1: Understand the hashing and checking process

   The password 'mypassword' is hashed. Then check_password_hash verifies if the given password matches the hash.

2. Step 2: Evaluate the two checks

   Checking with 'mypassword' returns True because it matches. Checking with 'wrongpass' returns False because it does not match.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Correct password = True, wrong password = False [OK]

Hint: Check returns True only if password matches hash exactly [OK]

Common Mistakes:

• Assuming check_password_hash returns the hash
• Mixing up True and False results
• Not understanding that hashes are one-way

4. Identify the error in this code snippet:

from werkzeug.security import generate_password_hash, check_password_hash
password = 'secret'
hash = generate_password_hash(password)
if check_password_hash(password, hash):
    print('Password matches')

medium

A. Password variable should be hashed twice

B. Arguments to check_password_hash are reversed

C. Missing import for check_password_hash

D. generate_password_hash should be called with bytes, not string

Solution

1. Step 1: Review the function signature of check_password_hash

   The correct order is check_password_hash(hashed_password, plain_password).

2. Step 2: Identify the argument order in the code

   The code passes password first and hash second, which is reversed and causes a logic error.

3. Final Answer:

   Arguments to check_password_hash are reversed -> Option B

4. Quick Check:

   check_password_hash(hashed, password) correct order [OK]

Hint: Pass hashed first, then plain password to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Thinking generate_password_hash needs bytes input
• Forgetting to import check_password_hash

5. You want to store user passwords securely and verify them during login. Which approach correctly uses Werkzeug functions in a Flask app?

hard

A. Hash passwords with generate_password_hash before storing, then verify with check_password_hash

B. Store plain passwords, then use check_password_hash on them

C. Encrypt passwords with generate_password_hash and decrypt during login

D. Store hashed passwords and compare them directly to plain passwords

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to protect user data from leaks.

2. Step 2: Use correct verification method

   Use check_password_hash to verify the plain password against the stored hash during login.

3. Step 3: Eliminate incorrect options

   Storing plain passwords is insecure. Hashing is one-way, so decrypting is impossible. Direct comparison of hash and plain password fails.

4. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash -> Option A

5. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Always hash before storing; verify with check_password_hash [OK]

Common Mistakes:

• Storing plain passwords
• Trying to decrypt hashes
• Comparing hash and plain password directly