webpass

Overview ¶

Package webpass verifies and computes the PBKDF2 password hashes used by the two dominant Python web frameworks: Django (pbkdf2_sha256$…) and Werkzeug / Flask (pbkdf2:sha256:…). These are the format of the user-credential rows in a Django/Flask database dump — a very common offline-crack target — that the credential toolkit could not previously verify, compute or crack.

Wrap-vs-native judgement ¶

Native. Both are PBKDF2-HMAC over the standard library's crypto/sha*, reusing the generic PBKDF2 already in internal/wpa; only the framework-specific string framing (separators, salt-as-string, base64 vs hex digest) is added here.

Verifiable / no confidently-wrong output ¶

The exact framing — PBKDF2-HMAC-SHA256, the salt used as raw bytes, a 32-byte derived key, Django's padded standard base64 vs Werkzeug's hex — was confirmed against the reference Django and Werkzeug libraries (an independent oracle) and against raw hashlib.pbkdf2_hmac. Verify constant-time-compares the recomputed derived key to the stored one, so a wrong password is reported as such, never asserted to match.

Covered / deferred ¶

Covered: Django pbkdf2_sha256 / pbkdf2_sha1, Werkzeug pbkdf2:{sha256,sha1, sha512}, and Werkzeug scrypt:N:r:p (the modern Flask default — see scrypt.go), verify + compute. Deferred: Django's bcrypt/argon2 hasher wrappers (those delegate to the bcrypt/argon2 tools).