argon2-cffi 21.1.0

The secure Argon2 password hashing algorithm.

Argon2 won the Password Hashing Competition and argon2-cffi is the simplest way to use it in Python and PyPy:

>>> from argon2 import PasswordHasher
>>> ph = PasswordHasher()
>>> hash = ph.hash("s3kr3tp4ssw0rd")
>>> hash  # doctest: +SKIP
'$argon2id$v=19$m=102400,t=2,p=8$tSm+JOWigOgPZx/g44K5fQ$WDyus6py50bVFIPkjA28lQ'
>>> ph.verify(hash, "s3kr3tp4ssw0rd")
True
>>> ph.check_needs_rehash(hash)
False
>>> ph.verify(hash, "t0t411ywr0ng")
Traceback (most recent call last):
  ...
argon2.exceptions.VerifyMismatchError: The password does not match the supplied hash

argon2-cffi’s documentation lives at Read the Docs, the code on GitHub. It’s rigorously tested on Python 3.5+, and PyPy3.

It implements Argon2 version 1.3, as described in Argon2: the memory-hard function for password hashing and other applications.

argon2-cffi for Enterprise

Available as part of the Tidelift Subscription.

The maintainers of argon2-cffi and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. Learn more.

Release Information

21.1.0 (2021-08-29)

Vendoring Argon2 @ 62358ba (20190702)

Backward-incompatible changes:

Microsoft stopped providing the necessary SDKs to ship Python 2.7 wheels and currenly the downloads amount to 0.09%. Therefore we have decided that Python 2.7 is not supported anymore.

Deprecations:

none

Changes:

There are indeed no changes whatsoever to the code of argon2-cffi. The Argon2 project also hasn’t tagged a new release since July 2019. There also don’t seem to be any important pending fixes.

This release is mainly about improving the way binary wheels are built (abi3 on all platforms).

Full changelog.

Credits & License

argon2-cffi is maintained by Hynek Schlawack and released under the MIT license.

The development is kindly supported by Variomedia AG.

A full list of contributors can be found in GitHub’s overview.

Vendored Code

Argon2

The original Argon2 repo can be found at https://github.com/P-H-C/phc-winner-argon2/.

Except for the components listed below, the Argon2 code in this repository is copyright (c) 2015 Daniel Dinu, Dmitry Khovratovich (main authors), Jean-Philippe Aumasson and Samuel Neves, and under CC0 license.

The string encoding routines in src/encoding.c are copyright (c) 2015 Thomas Pornin, and under CC0 license.

The BLAKE2 code in src/blake2/ is copyright (c) Samuel Neves, 2013-2015, and under CC0 license.

The authors of Argon2 also were very helpful to get the library to compile on ancient versions of Visual Studio for ancient versions of Python.

The documentation also quotes frequently from the Argon2 paper to avoid mistakes by rephrasing.