pythonhashbcryptpbkdf2

How to migrate password hashes from Passlib.bcrypt to Django's default pbkdf2_sha256?


I had a FastAPI app that had been using Passlib's bcrypt module to hash passwords.
Here's an example string that is stored in the database as a password: $2b$12$62GCnIkiQp7dE/N2.Al4t.ODW.JYXCz8rHHmaLt63NnML4xDgKhFK

Now, the problem is I'm not sure whether it's possible to migrate this hash over to my new django application, since django stores hashes in a string that looks like this: <algorithm>$<iterations>$<salt>$<hash>

I thought the solution could be that the PassLib hash is B64 encoded, but I'm not really sure how to decode it into something that works for Django.


Solution

  • Okay, so after trying around I came up with the solution

    First: add "django.contrib.auth.hashers.BCryptPasswordHasher" to settings.PASSWORD_HASHERS

    Now, you can to every string that looks $2b$12$62GCnIkiQp7dE/N2.Al4t.ODW.JYXCz8rHHmaLt63NnML4xDgKhFK you add bcrypt$ for the result to look like bcrypt$$2b$12$62GCnIkiQp7dE/N2.Al4t.ODW.JYXCz8rHHmaLt63NnML4xDgKhFK.
    Not sure why there have to be two dollar signs after the method name, but if they are not there - django raises an exception: it expect 5 objects from hash.split("$"), and the second object is called "empty".

    After doing this to my passwords that I used in my FastAPI app and adding users to django, authorization started to work.