---
id: flask-bcrypt
version: "1.0.1"
license: BSD
license_treatment: permissive
maintenance: active
---

# Flask-Bcrypt — Brcrypt hashing for Flask.

License: permissive · Maintenance: active · Downloads: 2.3M/mo

## What it is and what it does

Flask-Bcrypt is a Flask extension that integrates the bcrypt password-hashing algorithm into your application. Bcrypt is intentionally designed to be computationally slow, making it resistant to brute-force attacks even as hardware becomes faster—a significant advantage over older algorithms like MD5 or SHA1 that prioritize speed. The extension exposes two main methods: one to hash a password and one to verify a plaintext password against a stored hash.

You initialize it by passing your Flask app object to the Bcrypt class, then call its hashing and verification methods from anywhere in your application. It's a thin, focused wrapper around the bcrypt library, suitable for any Flask application that needs to store and validate user passwords securely.

Use it for:

- Hash user passwords during registration or password-change workflows in a Flask web application
- Verify user-supplied passwords during login against stored bcrypt hashes
- Protect sensitive authentication data in multi-user web applications where password compromise is a security risk
- Replace weak or fast hashing algorithms in legacy Flask applications with a modern, attack-resistant alternative

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Flask-Bcrypt wraps the bcrypt password-hashing library for use in Flask applications, providing secure password hashing and verification methods designed to resist brute-force attacks.

Yes. Flask-Bcrypt is a mature, actively maintained extension with no known vulnerabilities, low install friction, and a permissive license. It solves a critical security problem—password hashing—with a proven algorithm. Install it if you are building a Flask application that requires user authentication.

## Install

pip install flask-bcrypt
uv add flask-bcrypt
poetry add flask-bcrypt

## Installing Flask-Bcrypt

Before you install: Installation is straightforward with low friction—a pure Python wheel with only two runtime dependencies (Flask and bcrypt). The package maintains active status with recent commits, though the latest release dates to 2022-04-05.

License in practice: BSD license is permissive, allowing use in commercial and proprietary projects with minimal restrictions beyond attribution.

Quickstart:

pip install flask-bcrypt

from flask import Flask
from flask_bcrypt import Bcrypt

app = Flask(__name__)
bcrypt = Bcrypt(app)

pw_hash = bcrypt.generate_password_hash('hunter2')
bcrypt.check_password_hash(pw_hash, 'hunter2')  # returns True

Verify before relying:

- Whether the 2022-04-05 release date reflects active maintenance or if the package is in maintenance-only mode
- Python version support beyond 3.7, 3.8, 3.9 listed in classifiers

## Package facts

- License: BSD (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 2.3M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask password hashing, bcrypt flask extension, secure password storage flask, password verification flask, flask authentication hashing, bcrypt integration flask, password security flask, password-hashing, flask-extension, authentication

[View on SkillFed](https://skillfed.io/packages/flask-bcrypt) · [View on PyPI](https://pypi.org/project/flask-bcrypt/)