Question 1

Which Django version uses which iteration count?

Accepted Answer

Django increases the PBKDF2 iteration count each release as hardware gets faster: 3.1 = 216,000 / 3.2 = 260,000 / 4.0 = 320,000 / 4.1 = 390,000 / 4.2 = 600,000 / 5.0 = 720,000 / 5.1 = 870,000. Each version's PBKDF2PasswordHasher.iterations attribute holds the current default. Generated hashes are version-portable — a 3.2 hash works in 5.1. Django automatically rehashes on successful login if the stored iteration count is below the current default, gradually upgrading the database without user intervention.

Question 2

How do I apply this to auth_user?

Accepted Answer

`UPDATE auth_user SET password = 'pbkdf2_sha256$870000$salt$hash' WHERE username = 'admin';`. Django reads this column on login, parses the format, runs PBKDF2 with the same parameters against the typed password, and compares. The Django shell alternative is cleaner: `python manage.py shell` then `from django.contrib.auth.models import User; u = User.objects.get(username='admin'); u.set_password('newpass'); u.save()`.

Question 3

Why isn't Django using Argon2 or bcrypt?

Accepted Answer

Django supports both as optional hashers (Argon2PasswordHasher, BCryptSHA256PasswordHasher) but defaults to PBKDF2 because PBKDF2 has no external dependencies — it's pure Python via hmac and hashlib. Argon2 requires argon2-cffi (C bindings); bcrypt requires the bcrypt package. The PBKDF2 default works on any Python install without extra packages. For new Django projects, switching to Argon2 in PASSWORD_HASHERS is recommended — OWASP prefers it over PBKDF2.

Django Password Hash Generator

Frequently Asked Questions