pwdlib

pwdlib is a modern password hashing library for Python, created as an actively maintained successor to passlib. It provides a small, focused PasswordHash API that hashes and verifies passwords using strong, current algorithms like Argon2 and bcrypt, with sensible recommended defaults.

Because passlib stalled in maintenance and stopped working on Python 3.13+, pwdlib fills a critical gap for web frameworks and authentication systems that need reliable password storage. It supports transparent hash upgrades so applications can migrate users to stronger parameters or algorithms over time.

What You Get

• A PasswordHash class with hash, verify, and verify_and_update methods
• Argon2 and bcrypt hashers with a recommended() preset for secure defaults
• Transparent hash upgrading to migrate stored passwords to stronger settings
• Optional extras so you only install the algorithm backends you need
• A tiny, well-documented API that works on modern Python including 3.13+

Common Use Cases

• Hashing and verifying user passwords in web application login flows
• Migrating projects off the unmaintained passlib library
• Upgrading legacy password hashes to stronger algorithms over time
• Backing authentication in FastAPI and other Python web frameworks

Under The Hood

Architecture - pwdlib is organized around a PasswordHash aggregator that holds an ordered list of hasher implementations. Each hasher (Argon2, bcrypt) conforms to a common interface exposing hash, verify, and a check for whether a stored hash needs updating. verify() walks the configured hashers to identify the algorithm from the hash prefix, and verify_and_update() combines verification with re-hashing when parameters are stale. The recommended() factory wires up secure defaults.

Tech Stack - Pure Python packaged with a modern pyproject and managed with uv, using optional extras to pull in the argon2-cffi and bcrypt backends only when requested. Development uses a justfile for tasks and mkdocs for documentation.

Code Quality - The repository has CI builds, codecov coverage tracking, and a dedicated tests directory. The codebase is small, typed, and single-purpose, which keeps the security-sensitive surface easy to audit.

API Design - The public API is deliberately tiny and hard to misuse: a recommended() preset plus hash/verify/verify_and_update. This mirrors the ergonomics of passlib while removing legacy complexity, and thorough documentation lowers the learning curve.