gws.lib.password

Password hashing, checking and generation.

Passwords are hashed with PBKDF2 (100000 iterations) and a random salt. The encoded hash has the form $algorithm$salt$hash, where the hash is base64 (URL-safe) encoded. check reads the algorithm and salt back from the encoded value.

generate creates random passwords with a configurable length and number of lowercase, uppercase, digit and punctuation characters. generate_with_groups does the same for arbitrary character groups (SymbolGroup).

Example:

import gws.lib.password

encoded = gws.lib.password.encode('secret')
gws.lib.password.check('secret', encoded)  # True

pw = gws.lib.password.generate(min_len=12, max_len=16, min_digit=2)

Source code: gws.lib.password

Package Contents

gws.lib.password.check(password: str, encoded: str) → bool

Check if a password matches an encoded hash.

Parameters:

• password – Plain text password.

• encoded – Encoded hash, as returned by encode.

Returns:

True if the password matches, False if it does not or if the encoded hash is invalid.

gws.lib.password.compare(a: str, b: str) → bool

Compare two strings in constant time, to prevent timing attacks.

Parameters:

• a – First string.

• b – Second string.

Returns:

True if the strings are equal, False otherwise.

gws.lib.password.encode(password: str, algo: str = 'sha512') → str

Encode a password into a salted PBKDF2 hash.

Parameters:

• password – Plain text password.

• algo – Hash algorithm name, as in hashlib.

Returns:

The encoded hash in the format $algorithm$salt$hash.

gws.lib.password.generate(min_len: int = 16, max_len: int = 16, min_lower: int = 0, max_lower: int = 255, min_upper: int = 0, max_upper: int = 255, min_digit: int = 0, max_digit: int = 255, min_punct: int = 0, max_punct: int = 255) → str

Generate a random password.

Parameters:

• min_len – Minimum password length.

• max_len – Maximum password length.

• min_lower – Minimum number of lowercase letters.

• max_lower – Maximum number of lowercase letters.

• min_upper – Minimum number of uppercase letters.

• max_upper – Maximum number of uppercase letters.

• min_digit – Minimum number of digits.

• max_digit – Maximum number of digits.

• min_punct – Minimum number of punctuation characters.

• max_punct – Maximum number of punctuation characters.

Returns:

The password.

Raises:

ValueError – If the constraints cannot be satisfied.

gws.lib.password.generate_with_groups(groups: list[SymbolGroup], min_len: int = 16, max_len: int = 16) → str

Generate a random password from a list of symbol groups.

The count attribute of each group is updated.

Parameters:

• groups – Symbol groups.

• min_len – Minimum password length.

• max_len – Maximum password length.

Returns:

The password.

Raises:

ValueError – If the constraints cannot be satisfied.

class gws.lib.password.SymbolGroup(s, min_len, max_len)

A group of characters with the minimum and maximum number of occurrences in a generated password.

chars

count = 0

max

min