Password hashing with Werkzeug in Flask - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of password hashing in web applications?

Password hashing protects user passwords by converting them into a secure, unreadable format. This way, even if the database is leaked, attackers cannot see the original passwords.

beginner

Which Werkzeug functions are commonly used for password hashing and verification?

Werkzeug provides generate_password_hash() to create a hashed password and check_password_hash() to verify a password against its hash.

beginner

How do you hash a password using Werkzeug in Flask?

Use generate_password_hash(password) where password is the plain text password. It returns a hashed string safe to store in the database.

beginner

How do you check if a user-entered password matches the stored hash?

Use check_password_hash(stored_hash, password). It returns True if the password matches the hash, otherwise False.

beginner

Why should you never store plain text passwords in your database?

Storing plain text passwords risks user security if the database is leaked. Hashing ensures passwords are protected and unreadable by attackers.

Which Werkzeug function creates a hashed password?

A verify_password()

B check_password_hash()

C hash_password()

D generate_password_hash()

generate_password_hash() creates a secure hashed password string.

What does check_password_hash() return if the password matches?

A The hashed password

B True

C False

D The plain password

check_password_hash() returns True if the password matches the stored hash.

Why is hashing passwords important?

A To protect passwords if the database leaks

B To speed up login

C To make passwords longer

D To store passwords in plain text

Hashing protects passwords from being exposed if the database is compromised.

Which of these is NOT a good practice for password security?

A Hashing passwords before storing

B Using <code>generate_password_hash()</code>

C Storing plain text passwords

D Verifying passwords with <code>check_password_hash()</code>

Storing plain text passwords is insecure and should be avoided.

What type of value does generate_password_hash() return?

A Hashed password string

B Boolean

C Plain text password

D Integer

It returns a hashed password string safe for storage.

Explain how to securely store and verify passwords in a Flask app using Werkzeug.

Think about the two main Werkzeug functions and why hashing is important.

Describe why password hashing is critical for user security and what risks it prevents.

Consider what happens if passwords are stored as plain text.