User model with password in Flask - Step-by-Step Execution

Concept Flow - User model with password

Define User class

↓

Add password field (hashed)

↓

Create set_password method

↓

Hash plain password

↓

Store hashed password

↓

Create check_password method

↓

Compare input password hash with stored hash

↓

Return True if match, else False

This flow shows how a User model stores a hashed password and checks it securely.

Execution Sample

Flask

from werkzeug.security import generate_password_hash, check_password_hash

class User:
    def __init__(self, username):
        self.username = username
        self.password_hash = ''
    def set_password(self, password):
        self.password_hash = generate_password_hash(password)
    def check_password(self, password):
        return check_password_hash(self.password_hash, password)

Defines a User class that hashes passwords when set and verifies passwords by comparing hashes.

Execution Table

Step	Action	Input	Password Hash	Output
1	Create User instance	username='alice'	''	User object created
2	Call set_password	password='secret123'	hash('secret123')	Password hash stored
3	Call check_password	password='secret123'	hash('secret123')	True (password matches)
4	Call check_password	password='wrongpass'	hash('secret123')	False (password does not match)
5	End		hash('secret123')	Process complete

💡 Password check returns False when input password hash does not match stored hash

Variable Tracker

Variable	Start	After set_password	After check_password(True)	After check_password(False)
username	alice	alice	alice	alice
password_hash	''	hash('secret123')	hash('secret123')	hash('secret123')
check_password result	N/A	N/A	True	False

Key Moments - 2 Insights

Why do we store a hashed password instead of the plain password?

Storing a hashed password protects user security. The execution_table shows the password_hash stores a hash, not the plain password, preventing exposure if the database leaks.

How does check_password know if the password is correct?

check_password hashes the input and compares it to the stored hash. The execution_table rows 3 and 4 show True when hashes match and False when they don't.

Visual Quiz - 3 Questions

Look at the execution table, what is the password_hash after calling set_password with 'secret123'?

A '' (empty string)

B secret123

C hash('secret123')

D None

💡 Hint

Check Step 2 in the execution_table under Password Hash column

At which step does check_password return False?

A Step 4

B Step 3

C Step 2

D Step 1

💡 Hint

Look at the Output column in execution_table for check_password calls

If we change the input password in set_password, what changes in variable_tracker?

A username changes

B password_hash changes

C check_password result changes immediately

D Nothing changes

💡 Hint

See variable_tracker row for password_hash after set_password

Concept Snapshot

User model stores password securely by hashing it.
Use set_password to hash and save the password.
Use check_password to verify input against stored hash.
Never store plain passwords.
Use werkzeug.security helpers for hashing.
This protects user data if database leaks.

Full Transcript

This example shows a User class in Flask that handles passwords safely. When a password is set, it is hashed using generate_password_hash and stored in password_hash. When checking a password, check_password_hash compares the input password's hash with the stored hash. The execution table traces creating a user, setting a password, and checking it with correct and incorrect inputs. The variable tracker shows how password_hash changes after setting the password and how check_password returns True or False. Key moments clarify why hashing is important and how password verification works. The visual quiz tests understanding of password hashing and verification steps. This approach keeps user passwords safe by never storing them in plain text.