🔒 Bcrypt error using passlib

[trim sparrow]

I'm trying to hash password but it's throwing this two errors
'version = _bcrypt.about.version'
and
'ValueError: password cannot be longer than 72 bytes, truncate manually if necessary (e.g. my_password[:72])'

the code is attached. if anyone can help. I even tried to turncate the password with password[:72] , but it gives the same error. Idk what's wrong.
version: bcrypt 5.0.0 (on the previous version 4.3.0 the second error doesn't occur but the first error persists)

[mild violet]

@trim sparrow

Python help channel opened

Remember to:

• Ask your Python question, not if you can ask or if there's an expert who can help.
• Show a code sample as text (rather than a screenshot) and the error message, if you've got one.
• Explain what you expect to happen and what actually happens.

:warning: Do not pip install anything that isn't related to your question, especially if asked to over DMs.

Closes after a period of inactivity, or when you send !close.

[trim sparrow]

from passlib.hash import bcrypt_sha256

def hash_password(password: str) -> str:
    print(len(password.encode("utf-8")))  # prints 8
    return bcrypt_sha256.hash(password)


def verify_password(plain_password: str, hashed_password: str) -> bool:
    print(len(plain_password.encode("utf-8")))
    print(plain_password)
    print(hashed_password)
    return bcrypt_sha256.verify(plain_password, hashed_password)

[lavish wren]

bcrypt_sha256 shouldnt' throw that error at all. It should be doing the truncation equivalent already for you.

BCrypt was developed to replace md5_crypt for BSD systems. It uses a modified version of the Blowfish stream cipher. It does, however, truncate passwords to 72 bytes, and some other minor quirks (see BCrypt Password Truncation for details). This class works around that issue by first running the password through HMAC-SHA2-256. This class can be used directly as follows:

Are you sure this is the code you're running?

https://foss.heptapod.net/python-libs/passlib/-/issues?show=eyJpaWQiOiIxOTYiLCJmdWxsX3BhdGgiOiJweXRob24tbGlicy9wYXNzbGliIiwiaWQiOjIyMjYxMX0%3D

Ouch. Library bug.

[trim sparrow]

yup bro, I also moved to bcrypt_sha256 after normal bcrypt wasn't working, still this persists, I had to then post it here.

[trim sparrow]

let me use the previous bcrypt==4.3.0 version on this bcrypt_sha256 also.

[lavish wren]

It looks like passlib is undergoing a maintainer transition and is broken with the newer bcrypt, yeah

[trim sparrow]

yeah the first error still persists with the previous version 4.3.0

[lavish wren]

Fastapi moved to pwdlib, if that one still serves your needs, or you can pin bcrypt

[trim sparrow]

wait , let me try that out then

[lavish wren]

You may need to back bcrypt to 4.0.1, that one's in the issues files as a working version

But I haven't looked into the ramifications of that

[trim sparrow]

let's try pwdlib, that uses argon 2 , let's try it. argon is better than bcrypt tho

[trim sparrow]

well it's working

thx fr

without any error

pwdlib , I didn't know about this. I kept using the old passlib

time to uninstall passlib

[mild violet]

Python help channel closed for inactivity

This help channel has been closed. Feel free to create a new post in #1035199133436354600. To maximize your chances of getting a response, check out this guide on asking good questions.