# any reason for password field change

**URL:** <https://forum.djangoproject.com/t/any-reason-for-password-field-change/6041>\
**Category:** Using Django\
**Created:** [January 8, 2021, 12:45pm UTC](https://forum.djangoproject.com/t/any-reason-for-password-field-change/6041 "2021-01-08T12:45:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![millerthegorilla](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/millerthegorilla/32/3063_2.png) [@millerthegorilla](https://forum.djangoproject.com/u/millerthegorilla)\
**Post date:** [January 8, 2021, 12:45pm UTC](https://forum.djangoproject.com/t/any-reason-for-password-field-change/6041/1 "2021-01-08T12:45:57Z")

</div>

Hi, I am attempting to setup email verification for a site.

I have tried to use django.contrib.auth.tokens.default\_token\_generator. However, I always get an invalid result when I try and check the token.  
I had a look at the code, and when I print the user.password (which is used internally in the default\_token\_generator to calculate the hash value) in the make\_token function, it is different to when I print user.password in check\_token.  
Because the user.password field differs, the check\_token fails.

Any clues as to why the user.password field might change would be gratefully received.

Oh, and I’ve just checked. A user that hasn’t clicked on the email link, but has been made active via admin, can login.  
A user that has clicked on the email link, and has been made active by the admin, cannot login, as the password has definitely changed.

I have tried with both a postgres backend and the sqlitedb.

---

<div class="post-metadata">

**Author:** ![KenWhitesell](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/kenwhitesell/32/280_2.png) [@KenWhitesell](https://forum.djangoproject.com/u/KenWhitesell)\
**Post date:** [January 8, 2021, 1:12pm UTC](https://forum.djangoproject.com/t/any-reason-for-password-field-change/6041/2 "2021-01-08T13:12:49Z")

</div>

We would need to see all the relevant code here. This includes every function where you accept a password being entered in a form and every function where you are creating or comparing tokens. (This would be code that you have written, no need to post system code from Django.)

---

<div class="post-metadata">

**Author:** ![millerthegorilla](https://sea2.discourse-cdn.com/flex026/user_avatar/forum.djangoproject.com/millerthegorilla/32/3063_2.png) [@millerthegorilla](https://forum.djangoproject.com/u/millerthegorilla)\
**Post date:** [January 8, 2021, 1:36pm UTC](https://forum.djangoproject.com/t/any-reason-for-password-field-change/6041/3 "2021-01-08T13:36:40Z")

</div>

I have figured it out. In my register view, I was calling the function to make\_token and send email, before I called the registerView.super.  
So, I changed this:

```
def form_valid(self, form):
    user = form.save()
    sendConfirm(user)
    return super(RegisterView, self).form_valid(form)

```

To this:

```
def form_valid(self, form):
    user = form.save()
    bob = super(RegisterView, self).form_valid(form)
    sendConfirm(user)
    return bob

```

Internally, the sendConfirm is using a threaded function to send the email, and by the time the super class had been called, the link was sent with a password that was then overwritten by the threaded function.  
I will, of course, change bob to a more meaningful name…