Securely Hash User Passwords with Bcrypt in Python

import bcrypt

def hash_password(password: str) -> str:
    """Hashes a plaintext password using bcrypt."""
    # Generate a salt and hash the password
    # bcrypt.gensalt() generates a new salt with a default rounds value (12)
    # Higher rounds (cost) means more work, but slower hashing. Adjust based on hardware.
    hashed = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
    return hashed.decode('utf-8')

def check_password(password: str, hashed_password: str) -> bool:
    """Checks if a plaintext password matches a bcrypt hashed password."""
    return bcrypt.checkpw(password.encode('utf-8'), hashed_password.encode('utf-8'))

# Example Usage:
user_password = "mySuperSecretPassword123!"

# 1. Hash the password for storage
stored_hash = hash_password(user_password)
print(f"Original password: {user_password}")
print(f"Stored hash: {stored_hash}")

# 2. When user logs in, check their provided password against the stored hash
login_attempt_correct = "mySuperSecretPassword123!"
login_attempt_incorrect = "wrongPassword"

if check_password(login_attempt_correct, stored_hash):
    print(f"'{login_attempt_correct}' matches the stored hash. Login successful!")
else:
    print(f"'{login_attempt_correct}' does NOT match. Login failed.")

if check_password(login_attempt_incorrect, stored_hash):
    print(f"'{login_attempt_incorrect}' matches the stored hash. Login successful!")
else:
    print(f"'{login_attempt_incorrect}' does NOT match. Login failed.")