Best hashing method before storing password in database table for django

Question

def register(request): flag = True possible = '0123456789abcdefghijklmnopqrstuvwxyz' token = '' current_datetime = datetime.datetime.now() user = UsersModelForm() if request.method == 'POST': userf = UsersModelForm(request.POST) username = userf.data['username'] password = userf.data['password'] passwordrepeat = userf.data['passwordrepeat'] email = userf.data['email'] if password != passwordrepeat: flag = False passVariable = {'user':user, 'flag': False} return render_to_response('register.html', passVariable, context_instance=RequestContext(request)) elif password == passwordrepeat: for i in range(1,10): temp = random.choice(possible) token = token + temp print token if userf.is_valid(): check = userf.save(commit=False) check.email_token = token check.email_token_expiry = current_datetime + timedelta(1) check.save() return HttpResponseRedirect('/') else: return render_to_response('register.html', {"user": user, 'flag': True}, context_instance=RequestContext(request)) 

I need to apply the hash method for userf.data['password'] and userf.data['repeatpassword'] before saving to the database table.

Which hashing method is preferable for hashing using python?

Answer 1

Use bcrypt .

Here is an example taken from README :

 import bcrypt # Hash a password for the first time hashed = bcrypt.hashpw(password, bcrypt.gensalt()) # gensalt log_rounds parameter determines the complexity # the work factor is 2**log_rounds, and the default is 12 hashed = bcrypt.hashpw(password, bcrypt.gensalt(10)) # Check that an unencrypted password matches one that has # previously been hashed if bcrypt.hashpw(plaintext, hashed) == hashed: print "It matches" else: print "It does not match" 

Answer 2

You can find an explanation of how this is done for django.contrib.auth here . For more information, you can also view the make_password function in the hash module .