bcrypt Python Documentation

Passing a password longer than 72 bytes to hashpw now raises a ValueError. To avoid this, a common pattern is to hash the password with a cryptographic hash (like sha256) and then base64 encode the digest before passing it to bcrypt.

import bcrypt
import hashlib
import base64

password = b"an incredibly long password" * 10
hashed = bcrypt.hashpw(
    base64.b64encode(hashlib.sha256(password).digest()),
    bcrypt.gensalt()
)

To install the bcrypt package, use pip:

$ pip install bcrypt

On Linux, bcrypt requires a C compiler and a Rust compiler (minimum supported Rust version is 1.74.0). Use the following commands to install required dependencies based on your distribution:

Debian and Ubuntu:

$ sudo apt-get install build-essential cargo

Fedora and RHEL-derivatives:

$ sudo yum install gcc cargo

Alpine:

$ apk add --update musl-dev gcc cargo

As of version 3.0.0, bcrypt provides a kdf function which implements bcrypt_pbkdf. This is used in OpenSSH's newer encrypted private key format.

import bcrypt
key = bcrypt.kdf(
    password=b'password',
    salt=b'salt',
    desired_key_bytes=32,
    rounds=100)

Use bcrypt.hashpw() to hash a password with a randomly-generated salt, and bcrypt.checkpw() to verify if an unhashed password matches a previously hashed one. Note that inputs must be bytes.

import bcrypt
password = b"super secret password"
# Hash a password for the first time, with a randomly-generated salt
hashed = bcrypt.hashpw(password, bcrypt.gensalt())
# Check that an unhashed password matches one that has previously been
# hashed
if bcrypt.checkpw(password, hashed):
    print("It Matches!")
else:
    print("It Does not Match :(")

You can adjust the logarithmic work factor by passing the desired number of rounds to bcrypt.gensalt(rounds=N). The default is 12.

import bcrypt
password = b"super secret password"
# Hash a password for the first time, with a certain number of rounds
hashed = bcrypt.hashpw(password, bcrypt.gensalt(14))
# Check that an unhashed password matches one that has previously been
# hashed
if bcrypt.checkpw(password, hashed):
    print("It Matches!")
else:
    print("It Does not Match :(")