Password Hashing in Django

Why Hashing Matters

If a database were ever leaked, hashed passwords are useless to an attacker without enormous computing effort, unlike plain text passwords which are instantly readable.

Example: Why Hashing Matters

create_user() runs the password through Django's hasher automatically — the stored value is never the raw text.

python manage.py shell

>>> from django.contrib.auth.models import User
>>> user = User.objects.create_user(username='bob', password='SecurePass1')
>>> print(user.password)
pbkdf2_sha256$600000$...

Changing a Password Safely

set_password() re-hashes a new password and must be followed by save() to persist the change.

Note: Always call save() after set_password() — it only updates the in-memory object otherwise.

Example: Changing a Password Safely

set_password() hashes the new password in memory; save() writes the hashed value to the database.

python manage.py shell

>>> user.set_password('EvenSaferPass2')
>>> user.save()

Verifying a Password

check_password() safely compares a plain-text attempt against the stored hash, returning True or False.

Example: Verifying a Password

check_password() re-hashes the guess and compares hashes, so the real password is never exposed in the process.

python manage.py shell

>>> user.check_password('EvenSaferPass2')
True
>>> user.check_password('WrongGuess')
False