hash = hashlib.sha256(salt_buf + password) # the salt is prepended to the password as is (not as hex-bytes but as ASCII) for i in range(10000): hash = hashlib.sha256(hash.digest()) return ...