should I store all encrypted password to database using generate_password_hash()
<p>When I use <code>generate_password_hash()</code> function, I get a encrypted password string which contains a random salt.</p>

<pre><code>&gt;&gt;&gt; from werkzeug.security import generate_password_hash, check_password_hash
&gt;&gt;&gt; generate_password_hash('password')
&gt;&gt;&gt; 'pbkdf2:sha1:1000$3j8Brovx$9acddcd67da9e4c913817231c882a0f757e2d095'
</code></pre>

<p>If I store this string to database, someone else hacked into my database and get this string, it's easy to get the origin password using brute force cracking becasue the encrypted password contains the salt. </p>

<pre><code>check_password_hash('pbkdf2:sha1:1000$9HycZ0Qa$94f08a91fba1c040c5bffb6c7e1ab5a6ad4818de', 'password')
</code></pre>

<p>Should I encrypt the origin password using my own salt first before using <code>generate_password_hash()</code> or is there a better solution?</p>

<p>Thanks.</p>

<p>When you store password hashes, the main assumption is that it is too difficult to retrieve the password using brute force. If you want it to be safer, go for slower hash algorithims and longer passwords.</p>

<p>Encryption is worse than a hash because hash is irreversible and brute force is the only way to retrieve the password. With encryption, brute force is just one of the options.</p>

<p>Once that is clear, you have the option to have a "secret" salt in the code or salt can be saved with the hash. <strong>Saving the salt with the password is safer!</strong> Why? Because you have a different salt for each password, so the intruder has to brute force each password separately. If you have one global salt value, brute force can be done for all passwords in the datbase in one go.</p>

python encryption flask