Answer by spectras for Why isn't my Django User Model's Password Hashed?

The issue is DRF will simply set the field values onto the model. Therefore, the password is set on the password field, and saved in the database. But to properly set a password, you need to call the set_password() method, that will do the hashing.

There are several ways to do this, but the best way on rest framework v3 is to override the update() and create() methods on your Serializer.

class UserSerializer(serializers.ModelSerializer):    # <Your other UserSerializer stuff here>    def create(self, validated_data):        password = validated_data.pop('password', None)        instance = self.Meta.model(**validated_data)        if password is not None:            instance.set_password(password)        instance.save()        return instance    def update(self, instance, validated_data):        for attr, value in validated_data.items():            if attr == 'password':                instance.set_password(value)            else:                setattr(instance, attr, value)        instance.save()        return instance

Two things here:

1. we user self.Meta.model, so if the model is changed on theserializer, it still works (as long as it has a set_passwordmethod of course).
2. we iterate on validated_data items and notthe fields, to account for optionally excludeed fields.

Also, this version of create does not save M2M relations. Not needed in your example, but it could be added if required. You would need to pop those from the dict, save the model and set them afterwards.

FWIW, I thereby make all python code in this answer public domain worldwide. It is distributed without any warranty.