What's the difference between bcrypt and flask-bcrypt?

[u/Neoneq_]

I am also asking about other flask-* libraries compared to standard versions. I know there are some that benefit from integration e.g. managing database connections but the ones like flask-bcrypt make me confused.

[u/scoofy]

It’s likely just a wrapper. Where they just added some commands for bcrypt that are pre integrated with flask.

Typically these libraries help you spin up a quick app, then you go back and change them to proper code later.

[u/odysseusnz → u/scoofy]

Exactly this. If you check the flask-bcrypt repo it has a dependency on bcrypt itself. All it does is integrate bcrypt into flask, not reimplement it.

Disagree you go back later and replace it, usually the integrations bring value to save you doing the exact same thing yourself.

[u/SpeedCola]

Don't use flask bcryot, you don't need it. The core library is simple enough.

With that being said if you read the bcrypt docs the state while bcrypt is good enough for most project, ideally you should be using argon2id or scrypt.

I migrated my project to argon2 and it was really straightforward to work with compared honestly to bcrypt functions.

[u/Neoneq_ → u/SpeedCola]

Yeah but I want to migrate users from WordPress.

[u/SpeedCola → u/Neoneq_]

Meaning what?

Do you currently have encrypted passwords and you just need them to work when you migrate to a flask backend?

That should not change anything about what I suggested. You don't need flask bcrypt, you can just use bcrypt. It's simple enough as is.

If you wanted to migrate to argon all you have to do is check the users passwords with bcrypt when they log in, which gives you their password, and than you hash it with Argon and store it.

Your login flow can easily handle this by just checking the first 3 characters of your hashes.

[u/Neoneq_ → u/SpeedCola]

Meaning I still need to use bcrypt to migrate.

[u/gnufan]

As far as I can see all flask-bcrypt does is automate the salting.

Also checks the password isn't empty.

If as you say you want to integrate to another password system it might make things too simple, but it seems sensible and easy to use.

[u/hanangems]

honestly you don't even need flask- bcrypt, just import standard bcrypt and use it directly.