| Server IP : 178.105.222.151 / Your IP : 216.73.216.38 Web Server : nginx/1.28.3 System : Linux MNK 7.0.0-15-generic #15-Ubuntu SMP PREEMPT_DYNAMIC Wed Apr 22 16:06:43 UTC 2026 x86_64 User : www-data ( 33) PHP Version : 8.5.4 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /usr/share/doc/python3-passlib/html/ |
Upload File : |
<!DOCTYPE html>
<html lang="en" data-content_root="./">
<head>
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Frequently Asked Questions — Passlib vlatest Documentation</title>
<link rel="stylesheet" type="text/css" href="_static/pygments.css?v=fa44fd50" />
<link rel="stylesheet" type="text/css" href="_static/classic.css?v=2bf1fcf8" />
<script src="_static/documentation_options.js?v=c6e86fd7"></script>
<script src="_static/doctools.js?v=9bcbadda"></script>
<script src="_static/sphinx_highlight.js?v=dc90522c"></script>
<link rel="icon" href="_static/logo.ico"/>
<link rel="index" title="Index" href="genindex.html" />
<link rel="search" title="Search" href="search.html" />
<link rel="copyright" title="Copyright" href="copyright.html" />
<link rel="next" title="Modular Crypt Format" href="modular_crypt_format.html" />
<link rel="prev" title="Other Documentation" href="other.html" />
</head><body>
<div class="related" role="navigation" aria-label="Related">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
accesskey="I">index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="modular_crypt_format.html" title="Modular Crypt Format"
accesskey="N">next</a> |</li>
<li class="right" >
<a href="other.html" title="Other Documentation"
accesskey="P">previous</a> |</li>
<li class="nav-item nav-item-0"><a href="contents.html">Passlib latest Documentation</a> »</li>
<li class="nav-item nav-item-1"><a href="other.html" accesskey="U">Other Documentation</a> »</li>
<li class="nav-item nav-item-this"><a href="">Frequently Asked Questions</a></li>
</ul>
</div>
<div class="document">
<div class="documentwrapper">
<div class="bodywrapper">
<div class="body" role="main">
<section id="frequently-asked-questions">
<h1>Frequently Asked Questions<a class="headerlink" href="#frequently-asked-questions" title="Link to this heading">¶</a></h1>
<p>This sections documents some frequently asked questions about Passlib,
and password hashing in general. But it also includes some common
misconceptions, as well as some esoteric and infrequently asked questions.</p>
<ul>
<li><p><strong>Calling</strong> <a class="reference internal" href="lib/passlib.ifc.html#passlib.ifc.PasswordHash.hash" title="passlib.ifc.PasswordHash.hash"><code class="xref py py-meth docutils literal notranslate"><span class="pre">PasswordHash.hash()</span></code></a> <strong>multiple times for the same
input generates a different result! What’s going on?</strong></p>
<p>For all the hashes which include a salt, <a class="reference internal" href="lib/passlib.ifc.html#passlib.ifc.PasswordHash.hash" title="passlib.ifc.PasswordHash.hash"><code class="xref py py-meth docutils literal notranslate"><span class="pre">PasswordHash.hash()</span></code></a>
will automatically generate a new one each time it’s invoked.
Thus the salt & digest portions of the resulting hash string will be
different every time.</p>
</li>
<li><p><strong>Do I need to provide a salt each time</strong> <a class="reference internal" href="lib/passlib.ifc.html#passlib.ifc.PasswordHash.hash" title="passlib.ifc.PasswordHash.hash"><code class="xref py py-meth docutils literal notranslate"><span class="pre">PasswordHash.hash()</span></code></a> <strong>is called,
and store the salt separately in my database?</strong></p>
<p>No. Nearly all of the hash classes <a class="reference internal" href="lib/passlib.hash.html"><span class="doc">passlib.hash</span></a> which use
a salt will automatically generate a salt, and include it as part
of the hash that’s returned.</p>
<p>There are just a few hashes which require an external salt (like a username),
or don’t contain a salt at all. These generally aren’t secure, and shouldn’t
be used in unless you already know <em>why</em> you need to use them.</p>
</li>
<li><p><strong>How do I decrypt the hashes generated by Passlib?</strong></p>
<p><em>Short answer:</em> You can’t.</p>
<p><em>Long answer:</em></p>
<p>The hash algorithms in Passlib were explicitly designed so they are as hard to reverse as possible:
you can hash a password, you can check if a password matches an existing hash, and that’s it.
Unless it’s an ancient algorithm whose security has been fundamentally undermined,
the only way to reverse a hash is to use brute force: hash all potential passwords until one matches.
To fight this, one of the main goals of password hashing is to make this search take as long as possible.</p>
<p>However, if you really need it, there are programs dedicated to this task,
two prominent ones include <a class="reference external" href="http://www.openwall.com/john/">John the Ripper</a>
and <a class="reference external" href="https://hashcat.net/hashcat/">HashCat</a>.</p>
<p>There is one single decryptable hash in Passlib: <a class="reference internal" href="lib/passlib.hash.cisco_type7.html"><span class="doc">cisco_type7</span></a>,
which was deliberately designed this way; and Passlib’s implementation
offers a convenient <code class="xref py py-meth docutils literal notranslate"><span class="pre">decrypt()</span></code> method.</p>
</li>
<li><p><strong>Why use</strong> <a class="reference internal" href="lib/passlib.ifc.html#passlib.ifc.PasswordHash.verify" title="passlib.ifc.PasswordHash.verify"><code class="xref py py-meth docutils literal notranslate"><span class="pre">PasswordHash.verify()</span></code></a> <strong>instead of hashing user input
and using</strong> <code class="docutils literal notranslate"><span class="pre">==</span></code> <strong>to compare it with the stored hash?</strong></p>
<p>There are two reasons for this: One, <code class="xref py py-meth docutils literal notranslate"><span class="pre">PasswordHash.verify()</span></code> uses
a “constant time” equality check internally, which mitigates a class
of timing attacks that <code class="docutils literal notranslate"><span class="pre">==</span></code> is potentially vulnerable to.
These attacks are mostly theoretical for modern password hashes with a sufficient
sized-salt, but it’s better to be safe than sorry.</p>
<p>Two, many hash string formats encode a number of configuration parameters,
some unhelpfully allow multiple encodings of the <em>same</em> parameters.
Thus, to make sure passwords are hashed correctly for comparison, you’ll have to
parse the hash string and pass the configuration parameters in yourself.
<a class="reference internal" href="lib/passlib.ifc.html#passlib.ifc.PasswordHash.verify" title="passlib.ifc.PasswordHash.verify"><code class="xref py py-meth docutils literal notranslate"><span class="pre">PasswordHash.verify()</span></code></a> takes care of this transparently.</p>
</li>
<li><p><strong>Is SHA256-Crypt the same as SHA256?</strong>
<strong>Is MD5-Crypt the same as MD5?</strong></p>
<p>No. MD5 and SHA256 are cryptographic hash functions, which whereas <a class="reference internal" href="lib/passlib.hash.md5_crypt.html"><span class="doc">md5_crypt</span></a>
and <a class="reference internal" href="lib/passlib.hash.sha256_crypt.html"><span class="doc">sha256_crypt</span></a> are complex password hash algorithms, containing
a randomly generated salt, variable rounds, etc.
They derive their names from the fact that they use the respective
hash functions internally.</p>
</li>
</ul>
</section>
<div class="clearer"></div>
</div>
</div>
</div>
<div class="sphinxsidebar" role="navigation" aria-label="Main">
<div class="sphinxsidebarwrapper">
<p class="logo"><a href="contents.html">
<img class="logo" src="_static/masthead.png" alt="Logo of Passlib"/>
</a></p>
<search id="searchbox" style="display: none" role="search">
<h3 id="searchlabel">Quick search</h3>
<div class="searchformwrapper">
<form class="search" action="search.html" method="get">
<input type="text" name="q" aria-labelledby="searchlabel" autocomplete="off" autocorrect="off" autocapitalize="off" spellcheck="false"/>
<input type="submit" value="Go" />
</form>
</div>
</search>
<script>document.getElementById('searchbox').style.display = "block"</script>
<h3><a href="contents.html">Table of Contents</a></h3>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="index.html">Introduction</a></li>
<li class="toctree-l1"><a class="reference internal" href="narr/index.html">Walkthrough & Tutorials</a></li>
<li class="toctree-l1"><a class="reference internal" href="lib/index.html">API Reference</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="other.html">Other Documentation</a><ul class="current">
<li class="toctree-l2 current"><a class="current reference internal" href="#">Frequently Asked Questions</a></li>
<li class="toctree-l2"><a class="reference internal" href="modular_crypt_format.html">Modular Crypt Format</a></li>
<li class="toctree-l2"><a class="reference internal" href="history/index.html">Release History</a></li>
<li class="toctree-l2"><a class="reference internal" href="copyright.html">Copyrights & Licenses</a></li>
</ul>
</li>
</ul>
</div>
</div>
<div class="clearer"></div>
</div>
<div class="related" role="navigation" aria-label="Related">
<h3>Navigation</h3>
<ul>
<li class="right" style="margin-right: 10px">
<a href="genindex.html" title="General Index"
>index</a></li>
<li class="right" >
<a href="py-modindex.html" title="Python Module Index"
>modules</a> |</li>
<li class="right" >
<a href="modular_crypt_format.html" title="Modular Crypt Format"
>next</a> |</li>
<li class="right" >
<a href="other.html" title="Other Documentation"
>previous</a> |</li>
<li class="nav-item nav-item-0"><a href="contents.html">Passlib latest Documentation</a> »</li>
<li class="nav-item nav-item-1"><a href="other.html" >Other Documentation</a> »</li>
<li class="nav-item nav-item-this"><a href="">Frequently Asked Questions</a></li>
</ul>
</div>
<div class="footer" role="contentinfo">
© <a href="copyright.html">Copyright</a> 2008-2025, Assurance Technologies, LLC. Last Updated 2025-12-21.
Created using <a href="https://www.sphinx-doc.org/">Sphinx</a> 8.2.3.
</div>
</body>
</html>