pyscrypt

What it is and what it does

pyscrypt is a pure-Python reference implementation of the scrypt password-based key derivation function (PBKDF). It provides two main capabilities: hashing passwords with configurable work factors (N, r, p parameters) to produce cryptographic keys, and reading/writing files encrypted with the scrypt file format. The package has no external dependencies and supports both Python 2 and 3, though it is intentionally slow—the documentation explicitly states it is 'not meant to be fast, more of a reference solution.' The scrypt algorithm itself is CPU and memory intensive by design, making brute-force password attacks computationally expensive.

The package includes a ScryptFile class for transparent file encryption/decryption and a hash function for key derivation. It comes with test cases that can be validated against the command-line scrypt utility. However, the project has been abandoned since 2015, with the maintainer noting that faster C-wrapper implementations exist for production use. For most real-world applications requiring scrypt, a maintained C-based library would be preferable.

Use it for:

• Hashing user passwords for authentication systems where you need a slow, memory-hard key derivation function.
• Encrypting sensitive files using the scrypt file format for compatibility with the command-line scrypt utility.
• Educational or reference purposes to understand how scrypt works without external C dependencies.
• Legacy system maintenance where existing code depends on pyscrypt's pure-Python implementation.
• Scenarios where you cannot use compiled C extensions and need scrypt functionality despite performance trade-offs.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A pure-Python implementation of the scrypt password-based key derivation function that hashes passwords and encrypts/decrypts files using the scrypt algorithm.

No, unless you have a specific legacy dependency or educational need. The package is abandoned (last release 2015), explicitly slow by design, and the maintainer recommends C-wrappers for production use. For new projects, use a maintained scrypt library or bcrypt/argon2 instead. The lack of maintenance and known performance limitations make it unsuitable for most modern applications.

Install

pyscrypt on PyPI

pip install pyscrypt

uv add pyscrypt

poetry add pyscrypt

Installing pyscrypt

Before you install

High install friction: the package is abandoned (last release 2015-02-03, last commit 2022-07-02) with no external dependencies but relies on pure Python, making it slow by design. The maintainer explicitly notes it is 'not meant to be fast, more of a reference solution.' Consider a maintained C-wrapper alternative for production use.

License in practice

MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and open-source projects with minimal restrictions, provided you include the license notice.

Quickstart

import pyscrypt

# Hash a password
hashed = pyscrypt.hash(password=b"correct horse battery staple",
                       salt=b"seasalt",
                       N=1024, r=1, p=1, dkLen=32)

# Encrypt a file
with pyscrypt.ScryptFile('file.scrypt', b'password', 1024, 1, 1) as f:
    f.write(b"Hello World")

Python 3 requires password and salt as byte objects (b"..."), not strings. ScryptFile mode must be 'rb' or 'wb'.

Verify before relying

• Whether the pure-Python implementation is suitable for your security requirements or if a C-wrapper is necessary for production.
• Current compatibility with modern Python versions beyond the 2.x/3.x support stated in documentation.
• Whether the reference implementation has been audited for cryptographic correctness.

Package facts

Evidence: pyscrypt-1.6.2.tar.gz

Tags

More Cryptography packages