← Back to Chapters

Password Hashing, Change & Reset

? Password Hashing, Change & Reset

? Quick Overview

Django provides a secure and robust authentication system. Password hashing, changing passwords, and resetting forgotten passwords are handled using built-in utilities that follow industry best practices.

? Key Concepts

  • Passwords are never stored in plain text
  • Secure hashing using PBKDF2 by default
  • Session safety during password changes
  • Email-based password reset with tokens

? Password Hashing

Django automatically hashes passwords before storing them in the database using the django.contrib.auth module.

? View Code Example
# Create a user with automatic password hashing
from django.contrib.auth.models import User
user = User.objects.create_user(username='john_doe', password='password123')

? Changing a Password

Authenticated users can change their passwords securely using the set_password() method.

? View Code Example
# Change password and keep user logged in
from django.contrib.auth import update_session_auth_hash
user = request.user
user.set_password('new_password123')
user.save()
update_session_auth_hash(request, user)

? Password Reset

Django includes a full password reset workflow using email-based verification.

? View Code Example
# Send password reset email
from django.contrib.auth.forms import PasswordResetForm
from django.shortcuts import render, redirect

def password_reset_view(request):
    form = PasswordResetForm(request.POST or None)
    if request.method == 'POST' and form.is_valid():
        form.save(request=request)
        return redirect('password_reset_done')
    return render(request, 'password_reset.html', {'form': form})
? View Code Example
# Confirm and set new password
from django.contrib.auth.forms import SetPasswordForm
from django.shortcuts import render, redirect

def password_reset_confirm_view(request, user):
    form = SetPasswordForm(user, request.POST or None)
    if request.method == 'POST' and form.is_valid():
        form.save()
        return redirect('password_reset_complete')
    return render(request, 'password_reset_confirm.html', {'form': form})

? Interactive Flow

? User → Email Reset Link → Token Validation → New Password → Login

? Live Hashing Simulation

Type a password below to see what Django actually stores in the database.

 
Format: algorithm$iterations$salt$hash

? Use Cases

  • User account creation
  • Password updates for security
  • Forgotten password recovery

✅ Tips & Best Practices

  • Always use Django’s built-in authentication methods
  • Never store raw passwords
  • Ensure reset links expire
  • Use HTTPS for all auth flows

? Try It Yourself

  • Add password change functionality to your app
  • Customize password reset email templates
  • Test token expiration behavior