Das User-Model und authenticate()

Django ships a full User model out of the box, so you never write account tables by hand. It stores usernames, hashed passwords, and more. 👤

The model sits in django.contrib.auth, an app that is enabled in fresh projects. Import it and the whole auth toolkit comes along.

Each user has a username, plus email, first_name, and last_name. These are the everyday fields you read and display in your app.

Django stores a salted hash of every password, never the raw text. Even you, the developer, cannot read a user's actual password. 🔒

Use create_user so the password gets hashed for you. Setting the password by hand would store it in the clear.

The authenticate() function checks a username and password against the database for you. It is the heart of every login flow.

Pass it the credentials and it returns the matching user object when they are correct. No hashing or lookups for you to write.

If the username or password is wrong, authenticate() returns None. Always check for that before treating the user as logged in.

The is_active flag lets you disable accounts. By default authenticate() refuses to return inactive users, blocking banned logins.

Two extra flags matter: is_staff grants admin-site access, and is_superuser grants every permission. Most users have neither.

Remember: authenticate() only verifies identity. It does not start a session, so the user is not yet logged in after this call.

What does authenticate() return when the password is wrong?

You met Django's built-in User model and used authenticate() to verify credentials. Passwords stay hashed, and a failed check gives None. ✅