I agree there's a small risk of buggering up. But it's a one-time effort to get it right and reviewed, encrypting a string is not exactly rocket science. AES o

I agree there's a small risk of buggering up. But it's a one-time effort to get it right and reviewed, encrypting a string is not exactly rocket science. AES overhead is a non-issue for all but the very largest sites. A modern CPU can pipe north of 100MB/sec through AES - it's very unlikely to become the bottleneck in a python web-app.