1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
|
Metadata-Version: 2.3
Name: pwdlib
Version: 0.2.1
Summary: Modern password hashing for Python
Project-URL: Documentation, https://frankie567.github.io/pwdlib/
Project-URL: Source, https://github.com/frankie567/pwdlib
Author-email: pwdlib <fvoron@gmail.com>
License-File: LICENSE
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Topic :: Security
Classifier: Topic :: Security :: Cryptography
Requires-Python: >=3.8
Provides-Extra: argon2
Requires-Dist: argon2-cffi<24,>=23.1.0; extra == 'argon2'
Provides-Extra: bcrypt
Requires-Dist: bcrypt<5,>=4.1.2; extra == 'bcrypt'
Description-Content-Type: text/markdown
# pwdlib
<p align="center">
<em>Modern password hashing for Python</em>
</p>
[](https://github.com/frankie567/pwdlib/actions)
[](https://codecov.io/gh/frankie567/pwdlib)
[](https://badge.fury.io/py/pwdlib)
[](https://pepy.tech/project/pwdlib)
<p align="center">
<a href="https://polar.sh/frankie567">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="https://polar.sh/embed/subscribe.svg?org=frankie567&darkmode=1">
<img alt="Subscribe" src="https://polar.sh/embed/subscribe.svg?org=frankie567">
</picture>
</a>
</p>
---
**Documentation**: <a href="https://frankie567.github.io/pwdlib/" target="_blank">https://frankie567.github.io/pwdlib/</a>
**Source Code**: <a href="https://github.com/frankie567/pwdlib" target="_blank">https://github.com/frankie567/pwdlib</a>
---
## Quickstart
```sh
pip install 'pwdlib[argon2]'
```
```py
from pwdlib import PasswordHash
password_hash = PasswordHash.recommended()
hash = password_hash.hash("herminetincture")
password_hash.verify("herminetincture", hash) # True
```
## Why `pwdlib`?
For years, the de-facto standard to hash passwords was [`passlib`](https://foss.heptapod.net/python-libs/passlib). Unfortunately, it has not been very active recently and its [maintenance status is under question](https://foss.heptapod.net/python-libs/passlib/-/issues/187). Starting Python 3.13, `passlib` won't work anymore.
That's why I decided to start `pwdlib`, a password hash helper for the modern Python era. However, it's **not designed to be a complete replacement** for `passlib`, which supports numerous [hashing algorithms and features](https://passlib.readthedocs.io/en/stable/lib/index.html).
**✅ Goals**
- [x] Provide an easy-to-use wrapper to hash and verify passwords
- [x] Support modern and secure algorithms like Argon2 or Bcrypt
**❌ Non-goals**
- [ ] Support legacy hashing algorithms like MD5
- [ ] Implement algorithms directly — we should only rely on existing and battle-tested implementations
## Development
### Setup environment
We use [Hatch](https://hatch.pypa.io/latest/install/) to manage the development environment and production build. Ensure it's installed on your system.
### Run unit tests
You can run all the tests with:
```bash
hatch run test
```
### Format the code
Execute the following command to apply linting and check typing:
```bash
hatch run lint
```
### Publish a new version
You can bump the version, create a commit and associated tag with one command:
```bash
hatch version patch
```
```bash
hatch version minor
```
```bash
hatch version major
```
Your default Git text editor will open so you can add information about the release.
When you push the tag on GitHub, the workflow will automatically publish it on PyPi and a GitHub release will be created as draft.
## Serve the documentation
You can serve the Mkdocs documentation with:
```bash
hatch run docs-serve
```
It'll automatically watch for changes in your code.
## License
This project is licensed under the terms of the MIT license.
|
