How to Hash Passwords and Authenticate Users in Python

import hashlib
import hmac
import secrets
from dataclasses import dataclass
from typing import Optional


@dataclass
class User:
    id: int
    username: str
    password_hash: str
    salt: str


def hash_password(password: str) -> tuple[str, str]:
    salt = secrets.token_hex(16)
    password_hash = hashlib.pbkdf2_hmac(
        "sha256", password.encode(), salt.encode(), 100_000
    ).hex()
    return password_hash, salt


def verify_password(password: str, user: User) -> bool:
    computed = hashlib.pbkdf2_hmac(
        "sha256", password.encode(), user.salt.encode(), 100_000
    ).hex()
    return hmac.compare_digest(computed, user.password_hash)


def create_user(user_id: int, username: str, password: str) -> User:
    password_hash, salt = hash_password(password)
    return User(id=user_id, username=username, password_hash=password_hash, salt=salt)


def authenticate(username: str, password: str, users: dict[str, User]) -> Optional[User]:
    user = users.get(username)
    if user and verify_password(password, user):
        return user
    return None


if __name__ == "__main__":
    users_db = {}
    alice = create_user(1, "alice", "S3curePass!")
    users_db[alice.username] = alice

    result = authenticate("alice", "S3curePass!", users_db)
    print(f"Authenticated: {result.username if result else 'failed'}")
    wrong = authenticate("alice", "wrongpass", users_db)
    print(f"Wrong password: {wrong.username if wrong else 'failed'}")