[Django]-Django password hash different everytime

by

8👍

✅

You see different results because of the salt. In simple words Django add some random string to the password before hashing to get different values even for same password. This makes rainbaw tables attack are useless. Actually what you see in DB is not plain hash value, it’s structure in following format: <algorithm>$<iterations>$<salt>$<hash>

👤neverwalkaloner

8👍

Each time you use make_password, the password is hashed with a different salt. Django stores the salt with the hashed password. You can then use check_password to check the password later.

from django.contrib.auth.hashers import check_password, make_password
password = "helloworld"
h1 = make_password(password)
check_password(password, h1)  # returns True
check_password("incorrect", h1)  # returns False

Read the docs on how Django stores passwords for more info.

👤Alasdair

Leave a comment