How to compare plain text password to hashed password using bcrypt?
With py-bcrypt, you don't need to store the salt separately: bcrypt
stores the salt in the hash.
You can simply use the hash as a salt, and the salt is stored in the beginning of the hash.
>>> import bcrypt
>>> salt = bcrypt.gensalt()
>>> hashed = bcrypt.hashpw('secret', salt)
>>> hashed.find(salt)
0
>>> hashed == bcrypt.hashpw('secret', hashed)
True
>>>
The documentation doesn't mention storing the salt, it says you just have to:
#Initial generation
hashed = bcrypt.hashpw(password, bcrypt.gensalt())
#Store hashed in your db
#Load hashed from the db and check the provided password
if bcrypt.hashpw(password, hashed) == hashed:
print "It matches"
else:
print "It does not match"
http://www.mindrot.org/projects/py-bcrypt/