Introducing pwdlib, a modern password hash helper for Python

[frankie567]

Four years ago, I've made the first commit to FastAPI Users. At that time, all I wanted was a simple solution to manage users authentication in a FastAPI project. I didn't really have any specific experience in this field, other than what I knew from what other web frameworks like Django did.

Over time, this project grew in popularity and, to my own surprise, I started to actually like all the problematics and challenge related to authentication. Quickly, I created other related projects, like httpx-oauth before tackling a very big challenge, Fief.

I don't think it's necessary to explain you why, in this kind of projects, it's critical to hash users passwords. It's actually fun to see that the first commit of FastAPI Users already has a function to hash passwords using passlib.
This part hasn't changed much since, and you can find a very similar impIementation in Fief. For years, passlib has been the de-facto standard to hash passwords in Python, thanks to its wide algorithms support and well-designed helpers.

However, today, let me introduce you pwdlib, a modern password hash helper for Python.

Read more on Polar

[TheRealBecks]

First at all thank you for this library! So many people are searching for a modern, secure library that replaces passlib as that one's still a very serious security issue for many projects! 🙁 There were also several attempts to get Eli Collins from passlib to move on or give the project to a team that is willing to take care of it, but Eli abandoned the discussion once again. Very sad outcome!

You're saying that you don't want to replace passlib in total especially not the already implemented solutions that can be found in Python modules like hashlib - that's good! But there are still many algorithms missing like the ones used on other OSes like *BSD and Windows.

So my question here is: Are you open to add such features if someone opens PRs? Are these features in scope of your project? Because I can see the potential of your library and I hope that we (the users of Python) can find a solutions that will replace (most? all?) use cases of passlib 🙂

CC: @thbar @davidbrochart @ddanier

[frankie567]

Thank you for your kind words! It's indeed unfortunate for the Python community didn't get to secure the maintenance of passlib. In the thread you linked, some people disagree with starting a new initiative from scratch, and I completely understand why. The thing is, time flies, and it doesn't look like we're close to solving this maintenance issue. So I took on me to start this modest library.

Now, regarding your question with implementing new algorithms: I'm 100% open with supporting new ones if they're useful for the community.

However, it's important to note that I know very little about cryptography.

That's why I'll require that algorithm implementations are provided by third parties who know what they're doing (like we do now for Argon2 and Bcrypt) or, at most, just a few calls to cryptography functions if that's understandable for common folks and properly documented.

My main concern here is to keep folks secure and not introduce major security flaws because of my ignorance 😅