---
id: scrypt
version: "0.9.4"
license: 2-clause BSD
license_treatment: permissive
maintenance: aging
---

# scrypt — Bindings for the scrypt key derivation function library

License: permissive · Maintenance: aging · Downloads: 314.2K/mo

## What it is and what it does

Scrypt is a Python wrapper around the scrypt key derivation function, a cryptographic algorithm designed specifically for password hashing. Unlike fast hash functions such as MD5 or SHA, scrypt allows you to specify a minimum time cost for encryption and decryption operations—typically 0.05 to 0.5 seconds per operation. This makes brute-force password attacks computationally expensive: a user won't notice the delay when signing in, but an attacker trying billions of passwords will face hours or days of computation.

The package exports two main functions: `encrypt()` to hash a password with a time cost, and `decrypt()` to verify a password against a stored hash. It has no runtime dependencies and ships with precompiled wheels for modern Python versions on common platforms, though building from source requires OpenSSL headers. The library is stable but aging, with infrequent releases and modest maintenance activity.

Use it for:

- Secure password storage in web applications where you want to enforce a minimum verification time (e.g., 0.1 seconds per login attempt).
- Building a password verifier that rejects guesses that decrypt too quickly, indicating a wrong password or corrupted hash.
- Protecting against credential stuffing by making each password check computationally expensive without requiring external services.
- Legacy systems already using scrypt that need Python bindings to migrate or maintain existing password databases.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Python bindings for the scrypt key derivation function, enabling password-based encryption and decryption with tunable time costs to resist brute-force attacks.

Yes, if you need scrypt specifically and can tolerate medium install friction (compiled extension + OpenSSL dependency). The package is stable, permissively licensed, and has no known vulnerabilities. However, consider whether argon2 or PBKDF2 alternatives better suit your threat model—scrypt's time-cost model is effective but less commonly recommended for new projects than memory-hard functions like argon2. Install only if scrypt is your deliberate choice, not a default.

## Install

pip install scrypt
uv add scrypt
poetry add scrypt

## Installing scrypt

Before you install: Medium install friction due to compiled C extensions requiring OpenSSL development headers. Precompiled wheels available for Python 3.10–3.14 on macOS (ARM64), Linux (x86_64, aarch64, musllinux), and Windows. Last release 374 days ago; repository active but maintenance status is aging.

License in practice: Licensed under 2-clause BSD (permissive), allowing commercial and private use with minimal restrictions beyond attribution and liability disclaimers.

Quickstart:

import scrypt
import os

# Encrypt random data with a password
hashed = scrypt.encrypt(os.urandom(64), 'password', maxtime=0.1)

# Decrypt and verify
original = scrypt.decrypt(hashed, 'password', maxtime=0.1)

Requires OpenSSL development headers (libssl-dev on Debian/Ubuntu, openssl-devel on Fedora/RHEL, or precompiled wheels on macOS/Windows). Building from source on Windows requires OpenSSL installed to C:\OpenSSL-Win64 or C:\Program Files\OpenSSL.

Verify before relying:

- Whether the package is actively maintained beyond the aging status signal (last commit 2025-09-30 is recent, but release cadence is sparse).
- Performance characteristics and memory overhead compared to alternatives like argon2 or PBKDF2.

## Package facts

- License: 2-clause BSD (permissive)
- Python support: unspecified
- Install friction: medium
- Maintenance: aging
- Downloads: 314.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

scrypt password hashing, key derivation function, password encryption python, brute force resistant hashing, scrypt bindings, time-cost password verification, secure password storage, password-hashing, key-derivation, compiled-extension

[View on SkillFed](https://skillfed.io/packages/scrypt) · [View on PyPI](https://pypi.org/project/scrypt/)