Passlib
Python password hashing library providing a unified interface to 30+ password hashing algorithms (bcrypt, argon2, scrypt, pbkdf2, sha256_crypt, etc.). Handles hashing, verification, and hash migration. Used in FastAPI and Flask user authentication systems for secure password storage. The standard Python password hashing library despite being in maintenance mode.
Score Breakdown
⚙ Agent Friendliness
🔒 Security
Security-focused library with constant-time comparison. In maintenance mode but still secure. Passwords never stored in plaintext. Uses industry-standard algorithms.
⚡ Reliability
Best When
You need secure password hashing in Python with multiple algorithm support, legacy hash migration, or FastAPI's built-in security examples that reference passlib.
Avoid When
Starting fresh with argon2 only — use argon2-cffi directly without passlib overhead. Passlib is in maintenance mode.
Use Cases
- • Hash and verify user passwords securely in agent API backends with bcrypt or argon2 algorithms
- • Implement password migration from legacy hash algorithms to modern secure hashes in agent user systems
- • Use FastAPI's security utilities that rely on passlib CryptContext for OAuth2 password flow
- • Verify passwords in agent authentication middleware with constant-time comparison
- • Manage password policy and hash algorithm upgrades via CryptContext configuration
Not For
- • New projects seeking active maintenance — passlib is in maintenance mode; consider argon2-cffi directly for new projects
- • General cryptography beyond passwords — use the cryptography library for encryption, signing, etc.
- • Token generation — use secrets module for secure random tokens
Interface
Authentication
Local library for password hashing — implements auth primitives, not an auth provider.
Pricing
Completely free and open source. In maintenance mode — security patches only.
Agent Metadata
Known Gotchas
- ⚠ passlib is in maintenance mode — no new features; consider argon2-cffi for new projects, though passlib still works fine
- ⚠ bcrypt requires bcrypt package (pip install passlib[bcrypt]) — passlib itself doesn't include bcrypt C extension
- ⚠ argon2 requires argon2-cffi (pip install passlib[argon2]) — similar to bcrypt, extra install required
- ⚠ CryptContext.verify_and_update() returns (verified, new_hash) — the new_hash is non-None only when hash algorithm upgrade is needed; agents must persist the updated hash
- ⚠ Password hashing is intentionally CPU-intensive — in async agent APIs, run hash operations in executor (asyncio.run_in_executor) to avoid blocking event loop
- ⚠ deprecated=auto in CryptContext marks old schemes as deprecated but doesn't automatically rehash — call verify_and_update() not verify() to trigger rehashing
Alternatives
Full Evaluation Report
Detailed scoring breakdown, competitive positioning, security analysis, and improvement recommendations for Passlib.
Scores are editorial opinions as of 2026-03-06.