bcrypt

Modern password hashing for your software and your servers

bcrypt Permissive license Apache-2.0 Active ★ 1,499 v5.0.0 released 2025-09-25

Install

bcrypt on PyPI

pip

pip install bcrypt

uv

uv add bcrypt

poetry

poetry add bcrypt

Package facts

License	Apache-2.0 (permissive)
Python support	supports the current Python release (>=3.8)
Install friction	medium — platform-specific wheel
Runtime dependencies	none
Maintenance	actively maintained — 322 days since the last release
Last repo commit	2026-08-13
First released	2013-05-11
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: bcrypt-5.0.0-cp313-cp313t-macosx_10_12_universal2.whl; bcrypt-5.0.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; bcrypt-5.0.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl; bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_aarch64.whl; bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl; bcrypt-5.0.0-cp313-cp313t-manylinux_2_28_x86_64.whl; bcrypt-5.0.0-cp313-cp313t-manylinux_2_34_aarch64.whl; bcrypt-5.0.0-cp313-cp313t-manylinux_2_34_x86_64.whl; bcrypt-5.0.0-cp313-cp313t-musllinux_1_1_aarch64.whl; bcrypt-5.0.0-cp313-cp313t-musllinux_1_1_x86_64.whl; bcrypt-5.0.0-cp313-cp313t-musllinux_1_2_aarch64.whl; bcrypt-5.0.0-cp313-cp313t-musllinux_1_2_x86_64.whl; bcrypt-5.0.0-cp313-cp313t-win32.whl; bcrypt-5.0.0-cp313-cp313t-win_amd64.whl; bcrypt-5.0.0-cp313-cp313t-win_arm64.whl; bcrypt-5.0.0-cp314-cp314t-macosx_10_12_universal2.whl; bcrypt-5.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl; bcrypt-5.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl; bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl; bcrypt-5.0.0-cp314-cp314t-manylinux_2_28_armv7l.manylinux_2_31_armv7l.whl

Development Status :: 5 - Production/StableLicense :: OSI Approved :: Apache Software LicenseProgramming Language :: Python :: 3Programming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Programming Language :: Python :: Free Threading :: 3 - StableProgramming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPy

About bcrypt

from the package's own PyPI description — quoted content, verbatim

bcrypt

.. image:: https://img.shields.io/pypi/v/bcrypt.svg :target: https://pypi.org/project/bcrypt/ :alt: Latest Version

.. image:: https://github.com/pyca/bcrypt/workflows/CI/badge.svg?branch=main :target: https://github.com/pyca/bcrypt/actions?query=workflow%3ACI+branch%3Amain

Acceptable password hashing for your software and your servers (but you should really use argon2id or scrypt)

Installation

To install bcrypt, simply:

.. code:: console

$ pip install bcrypt

Note that bcrypt should build very easily on Linux provided you have a C compiler and a Rust compiler (the minimum supported Rust version is 1.56.0).

For Debian and Ubuntu, the following command will ensure that the required dependencies are installed:

.. code:: console

$ sudo apt-get install build-essential cargo

For Fedora and RHEL-derivatives, the following command will ensure that the required dependencies are installed:

.. code:: console

$ sudo yum install gcc cargo

For Alpine, the following command will ensure that the required dependencies are installed:

.. code:: console

$ apk add --update musl-dev gcc cargo

Alternatives

While...

Read as markdown · JSON record · Source repository

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

bcrypt provides secure password hashing using the bcrypt algorithm with an adjustable work factor, plus a KDF function for key derivation. It's implemented in Rust and offers constant-time password verification.

Medium install friction due to Rust compilation requirement for source builds. The package maintains active development with recent releases and broad platform support via pre-built wheels. No runtime dependencies simplifies deployment once installed.

Apache-2.0 permissive license allows commercial and private use with minimal restrictions, making it suitable for most projects including proprietary software.

Usage

pip install bcrypt

import bcrypt
password = b"super secret password"
hashed = bcrypt.hashpw(password, bcrypt.gensalt())
if bcrypt.checkpw(password, hashed):
    print("Password matches")

Rust compiler (minimum version 1.74) and C compiler required when building from source; pre-built wheels available for most platforms eliminate this for binary installations.

Verdict: bcrypt is a production-stable, actively maintained password hashing library with no known vulnerabilities and permissive licensing. Medium install friction applies mainly to source builds; wheel availability mitigates this for most users. The package explicitly acknowledges that argon2id or scrypt may be preferable for new projects, but remains a solid choice for password storage.

Needs verification

Whether pre-built wheels cover your specific platform/architecture combination (check PyPI for your Python version and OS)
Performance characteristics compared to argon2id or scrypt for your specific use case and security requirements

password hashing librarybcrypt password storagesecure password verificationkey derivation function kdfpassword hash with saltargon2 alternativeopenssl password hashing