Flask-Bcrypt

What it is and what it does

Flask-Bcrypt is a Flask extension that integrates the bcrypt password-hashing algorithm into your application. Bcrypt is intentionally designed to be computationally slow, making it resistant to brute-force attacks even as hardware becomes faster—a significant advantage over older algorithms like MD5 or SHA1 that prioritize speed. The extension exposes two main methods: one to hash a password and one to verify a plaintext password against a stored hash.

You initialize it by passing your Flask app object to the Bcrypt class, then call its hashing and verification methods from anywhere in your application. It's a thin, focused wrapper around the bcrypt library, suitable for any Flask application that needs to store and validate user passwords securely.

Use it for:

• Hash user passwords during registration or password-change workflows in a Flask web application
• Verify user-supplied passwords during login against stored bcrypt hashes
• Protect sensitive authentication data in multi-user web applications where password compromise is a security risk
• Replace weak or fast hashing algorithms in legacy Flask applications with a modern, attack-resistant alternative

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Flask-Bcrypt wraps the bcrypt password-hashing library for use in Flask applications, providing secure password hashing and verification methods designed to resist brute-force attacks.

Yes. Flask-Bcrypt is a mature, actively maintained extension with no known vulnerabilities, low install friction, and a permissive license. It solves a critical security problem—password hashing—with a proven algorithm. Install it if you are building a Flask application that requires user authentication.

Install

flask-bcrypt on PyPI

pip install flask-bcrypt

uv add flask-bcrypt

poetry add flask-bcrypt

Installing Flask-Bcrypt

Before you install

Installation is straightforward with low friction—a pure Python wheel with only two runtime dependencies (Flask and bcrypt). The package maintains active status with recent commits, though the latest release dates to 2022-04-05.

License in practice

BSD license is permissive, allowing use in commercial and proprietary projects with minimal restrictions beyond attribution.

Quickstart

pip install flask-bcrypt

from flask import Flask
from flask_bcrypt import Bcrypt

app = Flask(__name__)
bcrypt = Bcrypt(app)

pw_hash = bcrypt.generate_password_hash('hunter2')
bcrypt.check_password_hash(pw_hash, 'hunter2')  # returns True

Verify before relying

• Whether the 2022-04-05 release date reflects active maintenance or if the package is in maintenance-only mode
• Python version support beyond 3.7, 3.8, 3.9 listed in classifiers

Package facts

Evidence: Flask_Bcrypt-1.0.1-py3-none-any.whl

Tags

More Python Modules packages