Storing Them

Never store a password in any recoverable form. Not plain, not encrypted, not obfuscated. If you can recover it, so can whoever obtains your database, and the damage is not limited to your site because people reuse passwords.

Store a hash: a one-way transformation you can verify against but not reverse.

Three properties a password hash needs, and why a general-purpose hash like SHA-256 is the wrong tool.

Slow, deliberately. Fast hashing means an attacker tries billions per second. Password hashes have a work factor that can be raised as hardware improves.

Salted. A unique random value per password, so identical passwords produce different hashes and one precomputed table cannot crack them all.

Upgradeable. The algorithm should be able to change without forcing everyone to reset, by re-hashing on next successful login.

Django does all three. Argon2, bcrypt and scrypt are the algorithms to recognize.

✦ If you are comparing a password to a stored string, stop

That line means the password is stored recoverably, and the fix is not to encrypt it. Use the framework's hasher and its check function, which also handles the timing question: comparing hashes character by character can leak information through how long the comparison takes.