Modern Python Standard Library Cookbook

How it works...

There are two functions involved here:

• hash_password: Encodes a provided password in a way that is safe to store on a database or file
• verify_password: Given an encoded password and a plain text one provided by the user, it verifies whether the provided password matches the encoded (and thus saved) one

hash_password actually does multiple things; it doesn't just hash the password.

The first thing it does is generate some random salt that should be added to the password. That's just the sha256 hash of some random bytes read from os.urandom. It then extracts a string representation of the hashed salt as a set of hexadecimal numbers (hexdigest).

The salt is then provided to pbkdf2_hmac together with the password itself to hash ...