Python Password Hashing (Bcrypt)

A hash is designed to act as ”one-way-function” making it easy to perform but very hard to reverse. The reason why this is so beneficial when it comes to password managing and login handling, is because it allows the developers to convert the original password into a unique phrase that can be stored in the database. By using a hash function the application don’t have to match the original password in clear text with the password given upon login as it does not know what that password is. Instead it only need to know what hashing function where used and then see if the password entered generates the same hash value as the one saved in the database. This little trick provides the same login functionality as when all passwords were in clear text but the difference here is that now it’s only the user who knows exactly what the password is.

Is Hashing flawless?

However this technique is not flawless, as nothing is really secure when it comes to Information Security. Since the hashing algorithms are publicly known hackers can utilize them as well, meaning that they can pre generate a large file of popular passwords from previous leaks or they can simple just brute force all possible combinations given that they have unlimited time and computer resources. This is possible as they get the exact same hash value as any system using the same hashing function, allowing them to save the value next to the password in clear text.

This means that if someone manage to access the database and retrieve the stored hash values they can do a quick search in their own file for a similar hash value and read the original password used to generate it. A different approach has therefore been utilized on top of the original Hashing approach to counter this flaw.

Hashing + salt

As a hashing function generates a nearly unique value for a given sentence (Duplicates has been seen for some hashing algorithms, making them depreciated) you can alter the output by adding just a single change in the original input. This addition is referenced to as a salt value as it is a extra value that is put on top of the original input. By doing so hashing values stored in the database becomes altered and can no longer be pre computed unless the exact same salt value is used.    

With this basic introduction to Hashing and Salt values its time to see how such can be coded within the programming language Python. For this example the hashing function Bcrypt is used.

import bcrypt


passwordToHash = b'Thomas123'
enteredPassword = b'Thomas123'

hashedPassword = bcrypt.hashpw(passwordToHash, bcrypt.gensalt(10))


if bcrypt.checkpw(enteredPassword, hashedPassword):
    print('Password Match')
else:
    print('Password does not match')


print(hashedPassword)

Using the above Python code, its possible to Hash a password with a salt value and then make a quick check for wether the entered password matches the hashed one. The output of the above code is:

Password Match

b'$2b$10$ZVJzDIUKm6vQQgJzUhKuAeUhLvkuNTBQopf.r9grHEYCdf8Gr2Ude'

The first line comes from the conditional statement where the password is evaluated to match, the second line comes from the print statement where the hashed password is printed as an example.