BYTETOOLS

Django Password Hash Generator

Create a pbkdf2_sha256 password hash for Django with a random salt and your chosen iteration count, or verify a password against an existing hash.

Django password hash

Enter a password and press Generate hash to get apbkdf2_sha256$… string.

What is the Django Password Hash Generator?

The ByteTools Django Password Hash Generator builds the exact string Django stores in auth_user. password: pbkdf2_sha256, the iteration count, a random alphanumeric salt and the Base64 of 32 derived bytes, joined with dollar signs.

  • Produces Django's exact pbkdf2_sha256$iterations$salt$digest format
  • Cryptographically random 12-character salt from crypto.getRandomValues
  • Iteration presets matching Django 4.0 through 5.2 defaults
  • Verify mode re-derives using the salt parsed from an existing hash
  • Comparison runs without an early exit, so timing reveals nothing
  • Field-by-field breakdown of the encoded hash, all computed offline

How to use the Django Password Hash Generator

  1. 1

    Leave the mode on 'Generate a hash' and type the password you want to hash.

  2. 2

    Accept the auto-generated 12-character salt, or press 'New random salt' — or type your own.

  3. 3

    Set the iteration count directly, or pick the Django release whose default you want to match.

  4. 4

    Press 'Generate hash' and copy the pbkdf2_sha256$… string.

  5. 5

    To check a password instead, switch the mode to 'Verify', paste the stored hash and the candidate password, and press 'Verify password'.

About the Django Password Hash Generator

The ByteTools Django Password Hash Generator builds the exact string Django stores in auth_user.password: pbkdf2_sha256, the iteration count, a random alphanumeric salt and the Base64 of 32 derived bytes, joined with dollar signs. The key derivation uses PBKDF2-HMAC-SHA256 through your browser's native Web Crypto, so it matches Django's PBKDF2PasswordHasher byte for byte.

It is built for the moments where you need a real hash outside a Django shell — seeding a fixture, writing a data migration, populating a factory, or resetting an account straight in the database. A verify mode goes the other way: paste an existing hash and a candidate password, and the tool reads the salt and iteration count out of the hash, re-derives, and compares without an early exit.

Everything happens 100% locally in your browser. The password, the salt and the derived key are never uploaded, logged or stored anywhere, and the page keeps working with no network connection at all. Because the derivation is deliberately slow, a high iteration count will take a second or two to finish — that pause is the whole point of PBKDF2, and it is what an attacker has to pay for every guess.

Frequently asked questions

What format does Django use for passwords?

By default it stores four dollar-separated fields: the algorithm name pbkdf2_sha256, the iteration count, the salt, and the Base64-encoded derived key. Django reads the parameters back out of that string whenever it checks a password.

How many PBKDF2 iterations should I use?

Match whichever Django version your project runs, since that is what new passwords will use anyway — 600,000 for Django 4.2, 720,000 for 5.0, 870,000 for 5.1 and 1,000,000 for 5.2. Higher is harder to crack but slower on every login.

Can I paste this hash straight into my database?

Yes. Writing it to auth_user.password is exactly what set_password() and save() would have done, and Django will authenticate against it normally. Just make sure the iteration count and algorithm are ones your Django version supports.

Why does the same password give a different hash every time?

Because a fresh random salt is generated for each hash. That is the point of a salt: it means two users with the same password get different stored values, and one precomputed table cannot attack them both.

Is my password sent to a server?

No. PBKDF2 runs in your browser through the Web Crypto API, so the password never leaves your device. You can load the page, disconnect from the internet, and it still works.

Related tools