Password hashing with Werkzeug in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of password hashing in web applications?

Password hashing protects user passwords by converting them into a secure, unreadable format. This way, even if the database is leaked, attackers cannot see the original passwords.

beginner

Which Werkzeug functions are commonly used for password hashing and verification?

Werkzeug provides generate_password_hash() to create a hashed password and check_password_hash() to verify a password against its hash.

beginner

How do you hash a password using Werkzeug in Flask?

Use generate_password_hash(password) where password is the plain text password. It returns a hashed string safe to store in the database.

beginner

How do you check if a user-entered password matches the stored hash?

Use check_password_hash(stored_hash, password). It returns True if the password matches the hash, otherwise False.

beginner

Why should you never store plain text passwords in your database?

Storing plain text passwords risks user security if the database is leaked. Hashing ensures passwords are protected and unreadable by attackers.

Which Werkzeug function creates a hashed password?

A verify_password()

B check_password_hash()

C hash_password()

D generate_password_hash()

generate_password_hash() creates a secure hashed password string.

What does check_password_hash() return if the password matches?

A The hashed password

B True

C False

D The plain password

check_password_hash() returns True if the password matches the stored hash.

Why is hashing passwords important?

A To protect passwords if the database leaks

B To speed up login

C To make passwords longer

D To store passwords in plain text

Hashing protects passwords from being exposed if the database is compromised.

Which of these is NOT a good practice for password security?

A Hashing passwords before storing

B Using <code>generate_password_hash()</code>

C Storing plain text passwords

D Verifying passwords with <code>check_password_hash()</code>

Storing plain text passwords is insecure and should be avoided.

What type of value does generate_password_hash() return?

A Hashed password string

B Boolean

C Plain text password

D Integer

It returns a hashed password string safe for storage.

Explain how to securely store and verify passwords in a Flask app using Werkzeug.

Think about the two main Werkzeug functions and why hashing is important.

Describe why password hashing is critical for user security and what risks it prevents.

Consider what happens if passwords are stored as plain text.

Practice

1. What is the main purpose of using generate_password_hash in a Flask app?

easy

A. To generate random passwords for users

B. To check if a password matches the stored hash

C. To encrypt the entire user database

D. To securely convert a plain password into a hashed version before storing

Solution

1. Step 1: Understand the role of generate_password_hash

   This function takes a plain password and creates a hashed version that is safe to store.

2. Step 2: Differentiate from other functions

   check_password_hash is used to verify passwords, not generate them. Encryption of the whole database or generating random passwords are unrelated.

3. Final Answer:

   To securely convert a plain password into a hashed version before storing -> Option D

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hash passwords before storing to keep them safe [OK]

Common Mistakes:

• Confusing hashing with encryption
• Using check_password_hash to create hashes
• Thinking hashing generates random passwords

2. Which of the following is the correct way to import the password hashing functions from Werkzeug?

easy

A. from flask import generate_password_hash, check_password_hash

B. import werkzeug.hash as wh

C. from werkzeug.security import generate_password_hash, check_password_hash

D. import werkzeug.security.hash_password

Solution

1. Step 1: Recall the correct import path

   The password hashing functions are in werkzeug.security, so import them directly from there.

2. Step 2: Check each option

   from werkzeug.security import generate_password_hash, check_password_hash correctly imports both functions. import werkzeug.hash as wh uses a wrong module alias. from flask import generate_password_hash, check_password_hash tries to import from Flask, which is incorrect. import werkzeug.security.hash_password uses a non-existent import path.

3. Final Answer:

   from werkzeug.security import generate_password_hash, check_password_hash -> Option C

4. Quick Check:

   Correct import path = from werkzeug.security import generate_password_hash, check_password_hash [OK]

Hint: Import from werkzeug.security for hashing functions [OK]

Common Mistakes:

• Importing from flask instead of werkzeug
• Using wrong module names or aliases
• Trying to import non-existent functions

3. What will be the output of this code snippet?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
print(check_password_hash(hashed, 'mypassword'))
print(check_password_hash(hashed, 'wrongpass'))

medium

A. True\nFalse

B. False\nTrue

C. True\nTrue

D. False\nFalse

Solution

1. Step 1: Understand the hashing and checking process

   The password 'mypassword' is hashed. Then check_password_hash verifies if the given password matches the hash.

2. Step 2: Evaluate the two checks

   Checking with 'mypassword' returns True because it matches. Checking with 'wrongpass' returns False because it does not match.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Correct password = True, wrong password = False [OK]

Hint: Check returns True only if password matches hash exactly [OK]

Common Mistakes:

• Assuming check_password_hash returns the hash
• Mixing up True and False results
• Not understanding that hashes are one-way

4. Identify the error in this code snippet:

from werkzeug.security import generate_password_hash, check_password_hash
password = 'secret'
hash = generate_password_hash(password)
if check_password_hash(password, hash):
    print('Password matches')

medium

A. Password variable should be hashed twice

B. Arguments to check_password_hash are reversed

C. Missing import for check_password_hash

D. generate_password_hash should be called with bytes, not string

Solution

1. Step 1: Review the function signature of check_password_hash

   The correct order is check_password_hash(hashed_password, plain_password).

2. Step 2: Identify the argument order in the code

   The code passes password first and hash second, which is reversed and causes a logic error.

3. Final Answer:

   Arguments to check_password_hash are reversed -> Option B

4. Quick Check:

   check_password_hash(hashed, password) correct order [OK]

Hint: Pass hashed first, then plain password to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Thinking generate_password_hash needs bytes input
• Forgetting to import check_password_hash

5. You want to store user passwords securely and verify them during login. Which approach correctly uses Werkzeug functions in a Flask app?

hard

A. Hash passwords with generate_password_hash before storing, then verify with check_password_hash

B. Store plain passwords, then use check_password_hash on them

C. Encrypt passwords with generate_password_hash and decrypt during login

D. Store hashed passwords and compare them directly to plain passwords

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to protect user data from leaks.

2. Step 2: Use correct verification method

   Use check_password_hash to verify the plain password against the stored hash during login.

3. Step 3: Eliminate incorrect options

   Storing plain passwords is insecure. Hashing is one-way, so decrypting is impossible. Direct comparison of hash and plain password fails.

4. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash -> Option A

5. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Always hash before storing; verify with check_password_hash [OK]

Common Mistakes:

• Storing plain passwords
• Trying to decrypt hashes
• Comparing hash and plain password directly