Cybersecurity Password Hashing

How it works

Password hashing should make offline guessing expensive if a verifier database is stolen. General-purpose fast hashes such as SHA-256 alone are unsuitable for password storage. OWASP prefers Argon2id and documents scrypt as an alternative when Argon2id is unavailable. This standard-library demonstration uses scrypt with an independent random salt; a production account system also needs versioned parameters, rate limits and a maintained migration policy.

Run the code

Save the complete source as password-hashing.py in a separate learning folder, then run python password-hashing.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

import hashlib
import hmac
import secrets
salt = secrets.token_bytes(16)
parameters = dict(n=2**17, r=8, p=1, maxmem=256*1024*1024, dklen=32)
def derive(password):
    return hashlib.scrypt(password.encode("utf-8"), salt=salt, **parameters)
verifier = derive("fictional-library-passphrase")
assert hmac.compare_digest(verifier, derive("fictional-library-passphrase"))
assert not hmac.compare_digest(verifier, derive("different-passphrase"))
print("correct accepted; incorrect rejected")

Expected result

correct accepted; incorrect rejected

The salt is random for each enrolment and is stored with the verifier; it is not a secret password substitute. n=2**17, r=8 and p=1 follow the referenced scrypt baseline, with an explicit OpenSSL memory allowance. Test memory and latency under concurrency before deploying a real service. This program uses roughly 128 MiB for the scrypt work area and runs locally.