Flask-Bcrypt

Flask-Bcrypt is a lightweight Flask extension that wraps the bcrypt library to provide password hashing and comparison utilities with an API intentionally similar to Werkzeug’s built-in generate_password_hash/check_password_hash functions, making it an easy drop-in upgrade for stronger password hashing.

The entire extension lives in a single module and can be used either bound to a Flask app via Bcrypt(app) or as standalone module-level functions without any app context. It exposes configuration for the bcrypt work-factor (rounds) and handles bytes/string encoding differences transparently, and it has been a long-standing, widely depended-on choice for password storage in Flask applications.

What You Get

• A Bcrypt class that binds to a Flask app object and configures the bcrypt work factor via BCRYPT_LOG_ROUNDS
• Standalone generate_password_hash/check_password_hash module functions usable without an app context
• An API shaped to match Werkzeug’s built-in password hashing functions for easy migration
• Transparent handling of bytes/string encoding differences between Python and the underlying bcrypt library
• Configurable hashing rounds to tune the cost factor per environment (e.g. lower for tests, higher for production)

Common Use Cases

• Hashing user passwords before storing them in a database in a Flask authentication system
• Verifying a submitted login password against a stored bcrypt hash
• Migrating a Flask app from Werkzeug’s default password hashing to a stronger, configurable bcrypt implementation
• Hashing sensitive tokens or secrets where a slow, brute-force-resistant hash is preferable to fast algorithms like SHA-256

Under The Hood

Architecture The entire extension is a single ~225-line module (flask_bcrypt.py) containing a Bcrypt class that implements Flask’s extension pattern (init_app/constructor binding to app.extensions) and two standalone module-level functions (generate_password_hash, check_password_hash) that internally instantiate a bare Bcrypt() for use outside an app context. Tech Stack Pure Python with a hard dependency on the bcrypt C-extension package (>=3.1.1) for the actual hashing primitive and Flask for the extension binding pattern; no other runtime dependencies. Code Quality The module is thoroughly docstringed with usage examples inline for every public function, and test_bcrypt.py covers both the app-bound and standalone usage paths; the code has changed little in years, reflecting a stable, feature-complete single-purpose utility rather than an actively evolving codebase. API Design The public API was deliberately designed to mirror Werkzeug’s built-in generate_password_hash/check_password_hash signatures, so switching an existing Flask app from Werkzeug’s hashing to bcrypt requires little more than changing the import — there is effectively no new API surface to learn.