Password hashing with Werkzeug in Flask - Step-by-Step Execution

Concept Flow - Password hashing with Werkzeug

User inputs password

↓

Call generate_password_hash(password)

↓

Werkzeug creates hashed password

↓

Store hashed password safely

↓

User login attempt

↓

Call check_password_hash(stored_hash, input_password)

↓

Werkzeug compares input with stored hash

↓

Return True if match, False if not

This flow shows how a password is hashed when created and then checked during login using Werkzeug functions.

Execution Sample

Flask

from werkzeug.security import generate_password_hash, check_password_hash

password = 'mypassword123'
hashed = generate_password_hash(password)

check = check_password_hash(hashed, 'mypassword123')

This code hashes a password and then checks if a given input matches the hashed password.

Execution Table

Step	Action	Input	Output	Notes
1	Call generate_password_hash	'mypassword123'	hashed string (e.g. 'pbkdf2:sha256:260000$...')	Password is converted to a secure hash
2	Store hashed password	hashed string	Stored safely (e.g. database)	Hash is saved, not the plain password
3	Call check_password_hash	hashed string, 'mypassword123'	True	Input password matches the hash
4	Call check_password_hash	hashed string, 'wrongpass'	False	Input password does not match hash

💡 Password check returns True or False depending on match; no plain password is stored

Variable Tracker

Variable	Start	After Step 1	After Step 3	After Step 4
password	'mypassword123'	'mypassword123'	'mypassword123'	'mypassword123'
hashed	None	'pbkdf2:sha256:260000$...'	'pbkdf2:sha256:260000$...'	'pbkdf2:sha256:260000$...'
check	None	None	True	False

Key Moments - 2 Insights

Why can't we just store the plain password instead of hashing it?

Storing plain passwords is unsafe because if the database is leaked, attackers get all passwords. The execution_table step 2 shows we store only the hashed password, which is secure.

How does check_password_hash know if the input matches without decrypting?

It hashes the input password the same way and compares hashes. The execution_table steps 3 and 4 show it returns True or False based on this comparison.

Visual Quiz - 3 Questions

Look at the execution table, what is the output of generate_password_hash when given 'mypassword123'?

A A hashed string like 'pbkdf2:sha256:260000$...'

B The plain password 'mypassword123'

C True

D False

💡 Hint

Check Step 1 output in the execution_table

At which step does the password check return False?

A Step 1

B Step 3

C Step 4

D Step 2

💡 Hint

Look at the 'Output' column in execution_table for steps 3 and 4

If the input password changes, how does it affect the check variable in variable_tracker?

A It changes to True

B It changes to False

C It stays the same

D It becomes the hashed string

💡 Hint

See variable_tracker 'check' values after Step 3 and Step 4

Concept Snapshot

Password hashing with Werkzeug:
- Use generate_password_hash(password) to create a secure hash
- Store only the hashed password, never plain text
- Use check_password_hash(stored_hash, input_password) to verify
- Returns True if input matches hash, else False
- Keeps passwords safe even if data leaks

Full Transcript

This visual trace shows how Werkzeug helps secure passwords in Flask apps. First, the user password is turned into a hashed string using generate_password_hash. This hash is stored safely instead of the plain password. Later, when the user logs in, check_password_hash compares the stored hash with the input password by hashing the input and checking for a match. The output is True if they match, False otherwise. This process protects user passwords from exposure even if the database is compromised.

Practice

1. What is the main purpose of using generate_password_hash in a Flask app?

easy

A. To generate random passwords for users

B. To check if a password matches the stored hash

C. To encrypt the entire user database

D. To securely convert a plain password into a hashed version before storing

Solution

1. Step 1: Understand the role of generate_password_hash

   This function takes a plain password and creates a hashed version that is safe to store.

2. Step 2: Differentiate from other functions

   check_password_hash is used to verify passwords, not generate them. Encryption of the whole database or generating random passwords are unrelated.

3. Final Answer:

   To securely convert a plain password into a hashed version before storing -> Option D

4. Quick Check:

   Password hashing = secure storage [OK]

Hint: Hash passwords before storing to keep them safe [OK]

Common Mistakes:

• Confusing hashing with encryption
• Using check_password_hash to create hashes
• Thinking hashing generates random passwords

2. Which of the following is the correct way to import the password hashing functions from Werkzeug?

easy

A. from flask import generate_password_hash, check_password_hash

B. import werkzeug.hash as wh

C. from werkzeug.security import generate_password_hash, check_password_hash

D. import werkzeug.security.hash_password

Solution

1. Step 1: Recall the correct import path

   The password hashing functions are in werkzeug.security, so import them directly from there.

2. Step 2: Check each option

   from werkzeug.security import generate_password_hash, check_password_hash correctly imports both functions. import werkzeug.hash as wh uses a wrong module alias. from flask import generate_password_hash, check_password_hash tries to import from Flask, which is incorrect. import werkzeug.security.hash_password uses a non-existent import path.

3. Final Answer:

   from werkzeug.security import generate_password_hash, check_password_hash -> Option C

4. Quick Check:

   Correct import path = from werkzeug.security import generate_password_hash, check_password_hash [OK]

Hint: Import from werkzeug.security for hashing functions [OK]

Common Mistakes:

• Importing from flask instead of werkzeug
• Using wrong module names or aliases
• Trying to import non-existent functions

3. What will be the output of this code snippet?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
print(check_password_hash(hashed, 'mypassword'))
print(check_password_hash(hashed, 'wrongpass'))

medium

A. True\nFalse

B. False\nTrue

C. True\nTrue

D. False\nFalse

Solution

1. Step 1: Understand the hashing and checking process

   The password 'mypassword' is hashed. Then check_password_hash verifies if the given password matches the hash.

2. Step 2: Evaluate the two checks

   Checking with 'mypassword' returns True because it matches. Checking with 'wrongpass' returns False because it does not match.

3. Final Answer:

   True False -> Option A

4. Quick Check:

   Correct password = True, wrong password = False [OK]

Hint: Check returns True only if password matches hash exactly [OK]

Common Mistakes:

• Assuming check_password_hash returns the hash
• Mixing up True and False results
• Not understanding that hashes are one-way

4. Identify the error in this code snippet:

from werkzeug.security import generate_password_hash, check_password_hash
password = 'secret'
hash = generate_password_hash(password)
if check_password_hash(password, hash):
    print('Password matches')

medium

A. Password variable should be hashed twice

B. Arguments to check_password_hash are reversed

C. Missing import for check_password_hash

D. generate_password_hash should be called with bytes, not string

Solution

1. Step 1: Review the function signature of check_password_hash

   The correct order is check_password_hash(hashed_password, plain_password).

2. Step 2: Identify the argument order in the code

   The code passes password first and hash second, which is reversed and causes a logic error.

3. Final Answer:

   Arguments to check_password_hash are reversed -> Option B

4. Quick Check:

   check_password_hash(hashed, password) correct order [OK]

Hint: Pass hashed first, then plain password to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Thinking generate_password_hash needs bytes input
• Forgetting to import check_password_hash

5. You want to store user passwords securely and verify them during login. Which approach correctly uses Werkzeug functions in a Flask app?

hard

A. Hash passwords with generate_password_hash before storing, then verify with check_password_hash

B. Store plain passwords, then use check_password_hash on them

C. Encrypt passwords with generate_password_hash and decrypt during login

D. Store hashed passwords and compare them directly to plain passwords

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to protect user data from leaks.

2. Step 2: Use correct verification method

   Use check_password_hash to verify the plain password against the stored hash during login.

3. Step 3: Eliminate incorrect options

   Storing plain passwords is insecure. Hashing is one-way, so decrypting is impossible. Direct comparison of hash and plain password fails.

4. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash -> Option A

5. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Always hash before storing; verify with check_password_hash [OK]

Common Mistakes:

• Storing plain passwords
• Trying to decrypt hashes
• Comparing hash and plain password directly