flaskex | Simple flask example for quick prototypes | Application Framework library

The problem is that you're taking the value from a SQLAlchemy String column and passing it to bcrypt.checkpw. String is intended for Unicode strings, it provides values as str. But bcrypt only works on byte strings, so it expects a bytes. That's what the TypeError that says "Unicode-objects must be encoded before hashing" is telling you.

Depending on what database backend and DB-API library you're using (and, for some backends, on how your database is configured), when you save a bytes value s to a String column, it might save s.decode(), in which case you could just use user.password.encode() to get the same bytes back—but it might not. For example, it could also just save, say, str(s). In which case, if the hash were the bytes value b'abcd', the column value would be the string "b'abcd'", so and calling encode on that gets you b"b'abcd'", not b'abcd'.

The cleanest way to handle this is to use a Binary column¹—or, maybe better, Binary(60)²—to store your hashes, instead of a String column. Any DB-API that supports Binary will just store a bytes as-is, and return it as a bytes, which is exactly what you want.

_{1. Binary is an optional type. If it isn't present for your DB-ABI, the same type may be available as BINARY. If not, look through the list of types and try other types that inherit from _Binary. The ones without "large" in their name or acronym will probably be more efficient, but otherwise any of them should work.}

_{2. With the default settings, bcrypt printable digests will always be exactly 60 bytes. Databases can generally store fixed-width fields like BINARY(60) more compactly, and search them more quickly than variable-width fields like VARBINARY. Just using plain BINARY may be fine, but it may also work like VARBINARY, or it may waste space and work like BINARY(255), etc.}