bcrypt

library5.0.0pypypi✓ verified 51d ago

A Python library for modern password hashing, currently at version 5.0.0, with a release cadence of approximately every 6 months.

auth-security

pip install bcrypt

github ↗package ↗

Install & Compatibility

Where this runs

tested against v5.0.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.925 runs

installs and imports cleanly · install 0.0s · import 0.000s · 18.6MB

glibc

py 3.10–3.925 runs

installs and imports cleanly · install 1.6s · import 0.000s · 19MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

bcrypt

✓ import bcrypt

Ensure 'bcrypt' is imported directly; avoid 'from bcrypt import *' to prevent namespace pollution.

A simple example demonstrating how to hash and check passwords using bcrypt.

import bcrypt # Hash a password password = b"supersecret" salt = bcrypt.gensalt() hash = bcrypt.hashpw(password, salt) # Check a password if bcrypt.checkpw(password, hash): print("Password matches") else: print("Password does not match")

Debug

Known issues

breakingPassing a password longer than 72 bytes to hashpw now raises a ValueError; previously, it was silently truncated.

fix

Ensure passwords are 72 bytes or shorter before hashing.

affects: 5.0.0

deprecatedSupport for Python 3.7 has been dropped in version 4.3.0.

fix

Upgrade to Python 3.8 or later.

affects: 4.3.0

gotchabcrypt requires a C compiler and a Rust compiler (minimum supported Rust version is 1.56.0) for building from source.

fix

Install the necessary compilers or use pre-built wheels.

affects: All

Errors

Common errors & fixes

ModuleNotFoundError: No module named 'bcrypt'

The 'bcrypt' library is not installed in the Python environment being used, or the Python interpreter cannot find it.

fix

Install the library using pip: `pip install bcrypt` or `python -m pip install bcrypt`

ValueError: Invalid salt

This error typically occurs during password verification (`bcrypt.checkpw()`) when the provided hash is malformed, corrupted, or not a valid bcrypt hash, often due to incorrect storage, retrieval, or encoding.

fix

Ensure that the stored hash is retrieved correctly without alteration and that both the plaintext password and the stored hash are consistently encoded (e.g., `password.encode('utf-8')`) before being passed to `bcrypt.checkpw()`.

TypeError: Unicode-objects must be encoded before hashing

The `bcrypt` library functions like `bcrypt.hashpw()` and `bcrypt.checkpw()` require byte strings (e.g., `b'password'`) as input for passwords and hashes, but a Unicode string (Python's default `str` type) was provided.

fix

Encode the password string to bytes before passing it to `bcrypt` functions: `password_string.encode('utf-8')`

ValueError: Password too long

The bcrypt algorithm, as specified, only processes the first 72 bytes of a password. Since version 5.0.0 of the Python `bcrypt` library, providing a password longer than 72 bytes explicitly raises this `ValueError` instead of silently truncating it.

fix

Ensure that passwords do not exceed 72 bytes in length. If longer passwords are required, pre-hash them with another cryptographic hash function (e.g., SHA-256) and then pass the base64-encoded output of that hash to `bcrypt.hashpw()`.

Upgrade

Version history

5.0.0latest on PyPI

Audit

Dependencies

cryptographyrequiredProvides cryptographic recipes and primitives; required for bcrypt functionality.

Agent activity

54 hits · last 30 days

node

seranking-bot

ahrefsbot

amazonbot

Resources

githubhttps://github.com/pyca/bcrypt ↗

packagehttps://pypi.org/project/bcrypt/ ↗