bcrypt (Python)

bcrypt is the Python Cryptographic Authority’s implementation of the bcrypt password-hashing algorithm, exposing a small, purpose-built API (hashpw, checkpw, gensalt, kdf) for hashing and verifying passwords. Each hash embeds a randomly generated salt and a configurable logarithmic work factor (rounds), so verification is a single checkpw call and there is no separate salt-management step for callers to get wrong. As of 3.0.0 the core hashing routine is implemented in Rust (src/_bcrypt) rather than C, which the maintainers adopted for improved memory safety while keeping the same Python-facing API.

The library intentionally does one thing — bcrypt password hashing — rather than bundling multiple algorithms, and its README is explicit that depending on the use case, scrypt or argon2id may be preferable; bcrypt is offered as a well-understood, widely compatible baseline rather than the state of the art. It supports adjustable prefixes (2a/2b) for compatibility with other bcrypt implementations, enforces the algorithm’s 72-byte password limit by raising instead of silently truncating, and ships typed stubs (py.typed, .pyi) for static-analysis-friendly integration.

What You Get

• hashpw(password, salt) / checkpw(password, hashed) for one-line password hashing and verification
• gensalt(rounds=12) to generate a salt with a configurable, adjustable logarithmic work factor
• A kdf() function implementing bcrypt_pbkdf, used by OpenSSH’s encrypted private key format
• Prefix compatibility (2a/2b) for interoperating with other bcrypt implementations
• A memory-safe Rust core (since 3.0.0) behind the same stable Python API
• Typed stubs (py.typed) for static type checkers

Common Use Cases

• Hashing and verifying user account passwords in web applications
• Implementing OpenSSH-compatible key derivation via the kdf function
• Migrating legacy systems off weaker hashing (e.g. plain MD5/SHA1) onto a salted, work-factor-tunable scheme
• Providing the password-hashing backend for higher-level auth frameworks and ORM user models

Under The Hood

Architecture - The Python package (src/bcrypt/__init__.py) is a thin re-export layer over a compiled extension module _bcrypt, whose implementation lives in src/_bcrypt/src/lib.rs (a Rust crate built via setuptools-rust). All actual hashing, salt generation, and the bcrypt_pbkdf-based kdf function are implemented in Rust and exposed to Python through PyO3-style bindings, so the Python layer only handles imports, __all__, and version metadata. Tech Stack - Built with setuptools + setuptools-rust (build-backend setuptools.build_meta), targeting Python 3.9+ (including free-threaded builds) and PyPy 3, with a Cargo.toml/Cargo.lock pinning the Rust dependency graph; the minimum supported Rust version is documented as 1.74.0 in the README. Code Quality - Tests live in a single tests/test_bcrypt.py file exercising hashpw/checkpw/gensalt/kdf across prefixes, rounds, and edge cases like the 72-byte password limit; the small, focused test surface matches the library’s narrow scope, and noxfile.py drives CI across Python versions. API Design - The API is deliberately minimal — four top-level functions and no configuration objects or classes — which keeps the learning curve close to zero; the tradeoff is that anything beyond bcrypt itself (e.g. algorithm negotiation or upgrade paths) is left to the caller or a higher-level library.