Password storage best practices in Flask - Step-by-Step Execution

Concept Flow - Password storage best practices

User enters password

↓

Generate salt

↓

Hash password + salt

↓

Store salt + hash in DB

↓

User login attempt

↓

Retrieve salt + hash from DB

↓

Hash entered password + salt

↓

Compare hashes

↓

Grant or deny access

This flow shows how a password is salted and hashed before storage, then verified on login by hashing the entered password with the stored salt and comparing hashes.

Execution Sample

Flask

from flask import Flask, request
from werkzeug.security import generate_password_hash, check_password_hash

# Store hashed password
hashed = generate_password_hash('mypassword')

# Verify password
check_password_hash(hashed, 'mypassword')

This code hashes a password securely and then checks if a given password matches the stored hash.

Execution Table

Step	Action	Input	Output	Notes
1	User enters password	'mypassword'	Password string	Raw password input
2	Generate salt and hash	'mypassword'	Hashed password string	Salt is generated internally by generate_password_hash
3	Store hashed password	Hashed password string	Saved in database	Only hashed password stored, never raw password
4	User login attempt	'mypassword'	Password string	User inputs password again
5	Retrieve stored hash	User ID	Hashed password string	Get stored hash from DB
6	Hash entered password with salt	'mypassword'	Hashed password string	Salt is extracted from stored hash internally
7	Compare hashes	Hashed entered password vs stored hash	True or False	True if passwords match
8	Grant or deny access	Comparison result	Access granted or denied	Access granted only if True

💡 Process stops after access is granted or denied based on password match

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	After Step 6	After Step 7
password	None	'mypassword'	'mypassword'	'mypassword'	'mypassword'	'mypassword'
salt	None	Generated internally	Stored internally in hash	Retrieved internally	Used internally	Used internally
hashed_password	None	Generated hash string	Stored in DB	Retrieved from DB	Computed from input	Compared
check_result	None	None	None	None	None	True or False

Key Moments - 3 Insights

Why do we never store the raw password in the database?

Storing raw passwords is risky because if the database is leaked, attackers get all passwords. The execution_table shows we only store the hashed password (Step 3), which protects raw passwords.

What is the role of salt in password hashing?

Salt adds random data to the password before hashing to prevent attackers from using precomputed tables. The salt is generated and stored inside the hash (Step 2 and Step 3) and reused during verification (Step 6).

How does check_password_hash verify the password?

It extracts the salt from the stored hash, hashes the entered password with it, then compares hashes (Step 6 and Step 7). This ensures the entered password matches without storing raw passwords.

Visual Quiz - 3 Questions

Look at the execution_table, what is stored in the database after Step 3?

A Hashed password string with salt

B Salt only

C Raw password string

D User's plain text password

💡 Hint

Check Step 3 in execution_table where it says what is stored in the database.

At which step does the system compare the entered password with the stored password?

A Step 5

B Step 6

C Step 7

D Step 8

💡 Hint

Look at the 'Compare hashes' action in the execution_table.

If the salt was not used, how would the execution_table change?

A Step 6 would not hash the password

B Step 2 would not generate salt

C Step 7 would always return True

D Step 3 would store raw password

💡 Hint

Salt generation is shown in Step 2; without salt, that step changes.

Concept Snapshot

Password Storage Best Practices in Flask:
- Never store raw passwords.
- Use generate_password_hash() to hash with salt.
- Store only the hashed password.
- Use check_password_hash() to verify passwords.
- Salt is handled internally to protect against attacks.

Full Transcript

This visual execution shows how password storage works in Flask using best practices. When a user enters a password, the system generates a salt and hashes the password combined with the salt. This hashed password is stored in the database, never the raw password. On login, the system retrieves the stored hash and salt, hashes the entered password with the same salt, and compares the two hashes. If they match, access is granted. This process protects user passwords even if the database is compromised.

Practice

1. Why should you never store plain text passwords directly in your Flask application's database?

easy

A. Because plain text passwords can be easily stolen if the database is compromised.

B. Because plain text passwords take up more space than hashed passwords.

C. Because Flask does not support storing plain text passwords.

D. Because hashed passwords are faster to compare than plain text passwords.

Solution

1. Step 1: Understand password security risks

   Storing plain text passwords means if someone hacks the database, they get all user passwords directly.

2. Step 2: Importance of hashing

   Hashing transforms passwords into unreadable strings, protecting user data even if the database leaks.

3. Final Answer:

   Because plain text passwords can be easily stolen if the database is compromised. -> Option A

4. Quick Check:

   Password safety = Avoid plain text storage [OK]

Hint: Never store passwords as plain text, always hash first [OK]

Common Mistakes:

• Thinking hashing is optional
• Believing plain text is safe if database is secure
• Confusing hashing with encryption

2. Which of the following is the correct way to hash a password using Werkzeug in Flask?

easy

A. hashed = make_password(password)

B. hashed = generate_password_hash(password)

C. hashed = password_hash(password)

D. hashed = hash_password(password)

Solution

1. Step 1: Recall Werkzeug's hashing function

   Werkzeug provides generate_password_hash to hash passwords securely.

2. Step 2: Identify correct function usage

   The correct function call is generate_password_hash(password), other options are invalid or non-existent.

3. Final Answer:

   hashed = generate_password_hash(password) -> Option B

4. Quick Check:

   Use generate_password_hash() to hash passwords [OK]

Hint: Use generate_password_hash() from Werkzeug to hash passwords [OK]

Common Mistakes:

• Using non-existent functions like hash_password
• Confusing hashing with encryption functions
• Trying to hash passwords manually

3. What will the following Flask code output if the password check is correct?

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('secret123')
result = check_password_hash(hashed, 'secret123')
print(result)

medium

A. False

B. secret123

C. Error

D. True

Solution

1. Step 1: Understand generate_password_hash output

   This function creates a hashed string from 'secret123'.

2. Step 2: Check password correctness with check_password_hash

   It compares the hashed password with the plain text 'secret123' and returns True if they match.

3. Final Answer:

   True -> Option D

4. Quick Check:

   check_password_hash returns True if passwords match [OK]

Hint: check_password_hash returns True when password matches hash [OK]

Common Mistakes:

• Expecting the original password as output
• Confusing True/False return values
• Assuming check_password_hash modifies the hash

4. Identify the error in this Flask password check code:

from werkzeug.security import generate_password_hash, check_password_hash
hashed = generate_password_hash('mypassword')
if check_password_hash('mypassword', hashed):
    print('Access granted')

medium

A. The hashed and plain password arguments are reversed in check_password_hash.

B. generate_password_hash should not be used for hashing passwords.

C. The print statement should be outside the if block.

D. There is no error; the code works correctly.

Solution

1. Step 1: Check argument order in check_password_hash

   The first argument must be the hashed password, second is the plain password.

2. Step 2: Identify the reversed arguments

   The code passes plain password first and hash second, causing a logic error.

3. Final Answer:

   The hashed and plain password arguments are reversed in check_password_hash. -> Option A

4. Quick Check:

   check_password_hash(hash, password) order matters [OK]

Hint: Pass hashed first, plain password second to check_password_hash [OK]

Common Mistakes:

• Swapping arguments in check_password_hash
• Using generate_password_hash incorrectly
• Ignoring function argument order

5. You want to securely store user passwords in your Flask app and verify them on login. Which approach follows best practices?

hard

A. Store plain passwords in the database and compare them directly on login.

B. Encrypt passwords with a reversible method and decrypt them on login to compare.

C. Hash passwords with generate_password_hash before storing, then verify with check_password_hash during login.

D. Store passwords as plain text but log them only during login attempts.

Solution

1. Step 1: Understand secure password storage

   Passwords must be hashed before storing to prevent exposure if database leaks.

2. Step 2: Verify passwords securely on login

   Use check_password_hash to compare the stored hash with the login password safely.

3. Final Answer:

   Hash passwords with generate_password_hash before storing, then verify with check_password_hash during login. -> Option C

4. Quick Check:

   Hash before store, verify with check_password_hash [OK]

Hint: Hash before store, verify with check_password_hash on login [OK]

Common Mistakes:

• Storing or logging plain passwords
• Using reversible encryption instead of hashing
• Comparing plain passwords directly