# `passlib.hash` - Password Hashing Schemes

## Overview

The `passlib.hash` module contains all the password hash algorithms built into Passlib. While each hash has its own options and output format, they all inherit from the `PasswordHash` base interface. The following pages describe each hash in detail, including its format, underlying algorithm, and known security issues.

Danger

Many of the hash algorithms listed below are *NOT* secure.

Passlib supports a wide array of hash algorithms, primarily to support legacy data and systems. If you want to choose a secure algorithm for a new application, see the Quickstart Guide.

See also

PasswordHash Tutorial – for general usage examples

## Unix Hashes

Aside from “archaic” schemes such as `des_crypt`, most of the password hashes supported by modern Unix flavors adhere to the modular crypt format, allowing them to be easily distinguished when used within the same file. Variants of this format’s basic `$scheme$salt$digest` structure have also been adopted for use by other applications and password hash schemes.

## Other “Modular Crypt” Hashes

The modular crypt format is a loose standard for password hash strings which started life under the Unix operating system, and is used by many of the Unix hashes (above). However, it’s it’s basic `$scheme$hash` format has also been adopted by a number of application-specific hash algorithms:

## LDAP / RFC2307 Hashes

All of the following hashes use a variant of the password hash format used by LDAPv2. Originally specified in RFC 2307 and used by OpenLDAP [1], the basic format `{SCHEME}HASH` has seen widespread adoption in a number of programs.

### Standard LDAP Schemes

The following schemes are explicitly defined by RFC 2307, and are supported by OpenLDAP.

- `passlib.hash.ldap_md5` - MD5 digest

- `passlib.hash.ldap_sha1` - SHA1 digest

- `passlib.hash.ldap_salted_md5` - salted MD5 digest

- `passlib.hash.ldap_salted_sha1` - salted SHA1 digest

- `passlib.hash.ldap_salted_sha256` - salted SHA256 digest

- `passlib.hash.ldap_salted_sha512` - salted SHA512 digest

- `passlib.hash.ldap_crypt` - LDAP crypt() Wrappers

- `passlib.hash.ldap_plaintext` - LDAP-Aware Plaintext Handler

### Non-Standard LDAP Schemes

None of the following schemes are actually used by LDAP, but follow the LDAP format:

- `passlib.hash.ldap_hex_md5` - Hex-encoded MD5 Digest

- `passlib.hash.ldap_hex_sha1` - Hex-encoded SHA1 Digest

- `passlib.hash.ldap_pbkdf2_digest` - Generic PBKDF2 Hashes
- `passlib.hash.atlassian_pbkdf2_sha1` - Atlassian’s PBKDF2-based Hash
- `passlib.hash.fshp` - Fairly Secure Hashed Password

- `passlib.hash.roundup_plaintext` - Roundup-specific LDAP Plaintext Handler

## SQL Database Hashes

The following schemes are used by various SQL databases to encode their own user accounts. These schemes have encoding and contextual requirements not seen outside those specific contexts:

- `passlib.hash.mssql2000` - MS SQL 2000 password hash
- `passlib.hash.mssql2005` - MS SQL 2005 password hash
- `passlib.hash.mysql323` - MySQL 3.2.3 password hash
- `passlib.hash.mysql41` - MySQL 4.1 password hash
- `passlib.hash.postgres_md5` - PostgreSQL MD5 password hash
- `passlib.hash.oracle10` - Oracle 10g password hash
- `passlib.hash.oracle11` - Oracle 11g password hash

## MS Windows Hashes

The following hashes are used in various places by Microsoft Windows. As they were designed for “internal” use, they generally contain no identifying markers, identifying them is pretty much context-dependant.

- `passlib.hash.lmhash` - LanManager Hash
- `passlib.hash.nthash` - Windows’ NT-HASH
- `passlib.hash.msdcc` - Windows’ Domain Cached Credentials
- `passlib.hash.msdcc2` - Windows’ Domain Cached Credentials v2

## Other Hashes

The following schemes are used in various contexts, but have formats or uses which cannot be easily placed in one of the above categories:

- `passlib.hash.django_digest` - Django-specific Hashes
- `passlib.hash.grub_pbkdf2_sha512` - Grub’s PBKDF2 Hash
- `passlib.hash.hex_digest` - Generic Hexadecimal Digests
- `passlib.hash.plaintext` - Plaintext

Footnotes

[1]

OpenLDAP homepage - http://www.openldap.org/.