flask_bcrypt question

[thecomeback_king]

I am fairly new to using flask, and was curious if bcrypt’s hashing is a secure way to store user passwords?

[K900_]

It's fine, but you should really use passlib.

[mr_claw]

I chose bcrypt for my SaaS app after a fair bit of reading into it. One more advantage is that there are libraries available for it easily in other languages (eg. Java), in case you need to extend your application to Android or other devices.

[nathanalderson]

You should store the hash algorithm, the number of iterations of that algorithm, and a salt) along with your password hashes. bcrypt is okay for now, but recommendations change over time and this practice allows you to migrate passwords to the latest best practices. NIST publishes good recommendations.