Why is there a difference in format of encrypted passwords in Django
<p>I am using Django 1.97. The encrypted passwords are significantly different (in terms of the format).</p>

<p>Some passwords are of format $$$: </p>

<pre><code>pbkdf2_sha256$24000$61Rm3LxOPsCA$5kV2bzD32bpXoF6OO5YuyOlr5UHKUPlpNKwcNVn4Bt0=
</code></pre>

<p>While others are of format :</p>

<pre><code>!9rPYViI1oqrSMfkDCZSDeJxme4juD2niKcyvKdpB
</code></pre>

<p>Passwords are set either using <code>User.objects.create_user()</code> or <code>user.set_password()</code>. Is this difference an expected one ?</p>

<p>There is no significant difference between <code>User.objects.create_user()</code> and <code>user.set_password()</code> since first uses second.</p>

<p>Basically, passwords are in string with format <code>&lt;algorithm&gt;$&lt;iterations&gt;$&lt;salt&gt;$&lt;hash&gt;</code> according to <a href="https://docs.djangoproject.com/en/1.9/topics/auth/passwords/" rel="nofollow">docs</a>. The differences might come from <code>PASSWORD_HASHERS</code> settings variable. May be one password was created with one hasher and other password with another. But if you'll keep those hashers in variable mentioned above all should be fine, users will able to change it etc. You can read about it in little notice after <a href="https://docs.djangoproject.com/en/1.10/topics/auth/passwords/#using-bcrypt-with-django" rel="nofollow">bcrypt</a> section.</p>

<p>Also docs for <code>django.contrib.auth</code> package might be helpful too. <a href="https://docs.djangoproject.com/en/1.9/topics/auth/" rel="nofollow">Link</a>.</p>

<p><strong>UPDATE</strong>:</p>

<p>If you find documentation of an old django versions <a href="https://django.readthedocs.io/en/1.3.X/topics/auth.html#passwords" rel="nofollow">(1.3</a> for example), you will see that</p>

<blockquote>
  <p>Previous Django versions, such as 0.90, used simple MD5 hashes without password salts. For backwards compatibility, those are still supported; they'll be converted automatically to the new style the first time check_password() works correctly for a given user.</p>
</blockquote>

<p>So I think that the answer might be somewhere here. But it really depends on how legacy your project is, so you can decide if it's normal or what. Anyway you can issue <code>check_password()</code> to be sure. Or you can just email your user with "change password please" notification. There are many factors involved really.</p>

python django