How should a Python service hash passwords, tune the work factor, and upgrade old hashes?

Uses a password-specific algorithm, measurable work settings, and gradual rehashing without blocking service capacity.

1Say itAnswer out loud first

2CompareCompare with Core answer

3RefineRefine with Stronger and Advanced

TL;DR

I use a maintained password-hashing library with a password-specific algorithm such as Argon2, never a fast general hash like SHA-256. Each password gets a unique salt, and the encoded hash stores the algorithm and cost parameters needed for verification. I tune memory and time cost on the actual deployment so login is intentionally expensive but still sustainable. Plain passwords are never stored or logged.

Full answer below

Practice focus

Uses a password-specific algorithm, measurable work settings, and gradual rehashing without blocking service capacity.

Answer first

Answer path

Core answer first, then checkpoints toward a stronger answer.

Start
Core answer
Start here. This is the direct spoken answer to practice first.
Overview
Uses a password-specific algorithm, measurable work settings, and gradual rehashing without blocking service capacity.
I use a maintained password-hashing library with a password-specific algorithm such as Argon2, never a fast general hash like SHA-256. Each password gets a unique salt, and the encoded hash stores the algorithm and cost parameters needed for verification. I tune memory and time cost on the actual deployment so login is intentionally expensive but still sustainable. Plain passwords are never stored or logged.
Checkpoint
Stronger answer
Optional upgrade with examples, trade-offs, and sharper phrasing.
Verification should use the library API and a generic failure path that does not reveal whether the account exists. When the preferred algorithm or work factor changes, a successful login can verify the old hash and replace it with the new format. A dummy hash for unknown users can reduce obvious timing differences. Rate limits and concurrency limits still matter because attackers can use expensive verification as a resource attack.

Review signals

Use these to catch weak phrasing, shallow reasoning, and risky claims.

Common mistakesCandidateCommon mistakesMistakes that weaken the answer or signal shallow understanding.Open details

Details

Hashing passwords with a fast digest
Hard-coding a cost copied from another machine
Running unbounded CPU-heavy verification on the event loop

How should a Python service hash passwords, tune the work factor, and upgrade old hashes?

Practice focus

Answer path

Overview

Review signals

Follow-up prompts

Continue practice

Go deeper

Skill areas

Suggest an improvement

Found this answer useful?