How to Hash Passwords Securely in Python

import hashlib
import secrets
import time
import hmac


def hash_password(password: str, salt: str = None, pepper: str = "static-pepper") -> dict:
    """Hash a password with a random salt and constant pepper."""
    if salt is None:
        salt = secrets.token_hex(16)
    salted = f"{pepper}{salt}{password}"
    digest = hashlib.pbkdf2_hmac("sha256", salted.encode(), salt.encode(), 100_000)
    return {"salt": salt, "hash": digest.hex(), "iterations": 100_000}


def verify_password(password: str, stored: dict, pepper: str = "static-pepper") -> bool:
    """Verify password against stored hash and salt."""
    salted = f"{pepper}{stored['salt']}{password}"
    digest = hashlib.pbkdf2_hmac("sha256", salted.encode(), stored["salt"].encode(), stored["iterations"])
    return hmac.compare_digest(digest.hex(), stored["hash"])


def generate_api_key() -> str:
    """Generate a secure API key with timestamp prefix for tracking."""
    timestamp = int(time.time())
    random_part = secrets.token_hex(16)
    return f"{timestamp:x}.{random_part}"


if __name__ == "__main__":
    # Demo: create and verify a user
    user_password = "Beginner123!"
    stored = hash_password(user_password)
    print(f"Salt: {stored['salt'][:8]}...")
    print(f"Hash: {stored['hash'][:16]}...")

    # Correct password
    print(f"Valid login: {verify_password(user_password, stored)}")
    # Wrong password
    print(f"Invalid login: {verify_password('WrongPass', stored)}")

    # API key generation
    key = generate_api_key()
    print(f"API Key: {key[:20]}...")