scrypt

What it is and what it does

Scrypt is a Python wrapper around the scrypt key derivation function, a cryptographic algorithm designed specifically for password hashing. Unlike fast hash functions such as MD5 or SHA, scrypt allows you to specify a minimum time cost for encryption and decryption operations—typically 0.05 to 0.5 seconds per operation. This makes brute-force password attacks computationally expensive: a user won't notice the delay when signing in, but an attacker trying billions of passwords will face hours or days of computation.

The package exports two main functions: `encrypt()` to hash a password with a time cost, and `decrypt()` to verify a password against a stored hash. It has no runtime dependencies and ships with precompiled wheels for modern Python versions on common platforms, though building from source requires OpenSSL headers. The library is stable but aging, with infrequent releases and modest maintenance activity.

Use it for:

• Secure password storage in web applications where you want to enforce a minimum verification time (e.g., 0.1 seconds per login attempt).
• Building a password verifier that rejects guesses that decrypt too quickly, indicating a wrong password or corrupted hash.
• Protecting against credential stuffing by making each password check computationally expensive without requiring external services.
• Legacy systems already using scrypt that need Python bindings to migrate or maintain existing password databases.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Python bindings for the scrypt key derivation function, enabling password-based encryption and decryption with tunable time costs to resist brute-force attacks.

Yes, if you need scrypt specifically and can tolerate medium install friction (compiled extension + OpenSSL dependency). The package is stable, permissively licensed, and has no known vulnerabilities. However, consider whether argon2 or PBKDF2 alternatives better suit your threat model—scrypt's time-cost model is effective but less commonly recommended for new projects than memory-hard functions like argon2. Install only if scrypt is your deliberate choice, not a default.

Install

scrypt on PyPI

pip install scrypt

uv add scrypt

poetry add scrypt

Installing scrypt

Before you install

Medium install friction due to compiled C extensions requiring OpenSSL development headers. Precompiled wheels available for Python 3.10–3.14 on macOS (ARM64), Linux (x86_64, aarch64, musllinux), and Windows. Last release 374 days ago; repository active but maintenance status is aging.

License in practice

Licensed under 2-clause BSD (permissive), allowing commercial and private use with minimal restrictions beyond attribution and liability disclaimers.

Quickstart

import scrypt
import os

# Encrypt random data with a password
hashed = scrypt.encrypt(os.urandom(64), 'password', maxtime=0.1)

# Decrypt and verify
original = scrypt.decrypt(hashed, 'password', maxtime=0.1)

Requires OpenSSL development headers (libssl-dev on Debian/Ubuntu, openssl-devel on Fedora/RHEL, or precompiled wheels on macOS/Windows). Building from source on Windows requires OpenSSL installed to C:\OpenSSL-Win64 or C:\Program Files\OpenSSL.

Verify before relying

• Whether the package is actively maintained beyond the aging status signal (last commit 2025-09-30 is recent, but release cadence is sparse).
• Performance characteristics and memory overhead compared to alternatives like argon2 or PBKDF2.

Package facts

Evidence: scrypt-0.9.4-cp310-cp310-macosx_14_0_arm64.whl; scrypt-0.9.4-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; scrypt-0.9.4-cp310-cp310-musllinux_1_2_x86_64.whl; scrypt-0.9.4-cp310-cp310-win_amd64.whl; scrypt-0.9.4-cp311-cp311-macosx_14_0_arm64.whl; scrypt-0.9.4-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; scrypt-0.9.4-cp311-cp311-musllinux_1_2_x86_64.whl; scrypt-0.9.4-cp311-cp311-win_amd64.whl; scrypt-0.9.4-cp312-cp312-macosx_14_0_arm64.whl; scrypt-0.9.4-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl; scrypt-0.9.4-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; scrypt-0.9.4-cp312-cp312-musllinux_1_2_x86_64.whl; scrypt-0.9.4-cp312-cp312-win_amd64.whl; scrypt-0.9.4-cp313-cp313-macosx_14_0_arm64.whl; scrypt-0.9.4-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; scrypt-0.9.4-cp313-cp313-musllinux_1_2_x86_64.whl; scrypt-0.9.4-cp313-cp313-win_amd64.whl; scrypt-0.9.4-cp314-cp314-macosx_14_0_arm64.whl; scrypt-0.9.4-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl; scrypt-0.9.4-cp314-cp314-musllinux_1_2_x86_64.whl

Tags

More Libraries packages