---
id: bcrypt
version: "5.0.0"
license: Apache-2.0
license_treatment: permissive
maintenance: active
---

# bcrypt — Modern password hashing for your software and your servers

License: permissive · Maintenance: active · Popularity: top 1,000 on PyPI

## Install

pip install bcrypt
uv add bcrypt
poetry add bcrypt

## Description

bcrypt
======

.. image:: https://img.shields.io/pypi/v/bcrypt.svg
    :target: https://pypi.org/project/bcrypt/
    :alt: Latest Version

.. image:: https://github.com/pyca/bcrypt/workflows/CI/badge.svg?branch=main
    :target: https://github.com/pyca/bcrypt/actions?query=workflow%3ACI+branch%3Amain

Acceptable password hashing for your software and your servers (but you should
really use argon2id or scrypt)


Installation
============

To install bcrypt, simply:

.. code:: console

    $ pip install bcrypt

Note that bcrypt should build very easily on Linux provided you have a C
compiler and a Rust compiler (the minimum supported Rust version is 1.56.0).

For Debian and Ubuntu, the following command will ensure that the required dependencies are installed:

.. code:: console

    $ sudo apt-get install build-essential cargo

For Fedora and RHEL-derivatives, the following command will ensure that the required dependencies are installed:

.. code:: console

    $ sudo yum install gcc cargo

For Alpine, the following command will ensure that the required dependencies are installed:

.. code:: console

    $ apk add --update musl-dev gcc cargo


Alternatives
============

While...

## AI interpretation — verify before relying

bcrypt provides secure password hashing using the bcrypt algorithm with an adjustable work factor, plus a KDF function for key derivation. It's implemented in Rust and offers constant-time password verification.

Verdict: bcrypt is a production-stable, actively maintained password hashing library with no known vulnerabilities and permissive licensing. Medium install friction applies mainly to source builds; wheel availability mitigates this for most users. The package explicitly acknowledges that argon2id or scrypt may be preferable for new projects, but remains a solid choice for password storage.

[View on SkillFed](https://skillfed.io/packages/bcrypt) · [View on PyPI](https://pypi.org/project/bcrypt/)