I'm trying to wrap my mind around scrypt and how it's hashing works. I've got a basic function that will create a scrypt hash, however it seems that everytime I run it, the hash is different. Does scrypt always output a different hash, if so, why?

from passlib.hash import scrypt

def scrypt_hash(string, salt=None, front=False, back=False):
    print scrypt.hash(string)

#<= $scrypt$ln=16,r=8,p=1$3RvjfE9JCWEMobT2HoPQ+g$fv0toINPck6zSYD5+QqKUFi4GkptYT/deJ/C8R0JLSU
#<= $scrypt$ln=16,r=8,p=1$Xus9x/g/p1QK4bzX+p9zLg$G/JbYOw8Km1l57MUescXrPEjbVz8GIh8lPyIlOI9rMc
#<= $scrypt$ln=16,r=8,p=1$qzXGOIew1npvzZnzvpdSqg$17/frDtJOPnOODHSXOM4kw6N3oUNLltLOTf+odzZ8RA

If you don't specify a salt, one is randomly generated. The salt is different each time, so the hash will also be different.

salt (str) – Optional salt string. If specified, the length must be between 0-1024 bytes. If not specified, one will be auto-generated (this is recommended).


| improve this answer | |
  • So there is not way to produce a script hash without salt? – 13aal May 9 '17 at 13:23
  • 1
    You would never want to produce an scrypt digest without a salt; such a design would have no resistance to precomputation attacks like rainbow tables. – Polynomial May 11 '17 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.