Password storage in Django
Django does not store passwords in plain text form in the database. Instead, passwords are digested with a hashing algorithm, such as PBKDF2/SHA256, BCrypt/SHA256, or Argon2. As hashing algorithms are a one-way transformation, this prevents a user’s password from being decrypted from the hash stored in the database. This often comes as a surprise to users who expect a system administrator to retrieve their forgotten password, but it is best practice in security design. So, if we query the database for the password, we will see something like this:
Figure 9.4 – Password hashes in a Django SQLite3 database
The components of this string are <algorithm>$<iterations>$<salt>$<hash>. As several hashing algorithms have been compromised over time and we sometimes need to work with mandated security requirements, Django is flexible enough to accommodate new algorithms and can maintain data encrypted...
