This caught me out. Adding a warning.

scripts/hash_password

@@ -46,6 +46,9 @@ if __name__ == "__main__":
         bcrypt_rounds = config.get("bcrypt_rounds", bcrypt_rounds)
         password_config = config.get("password_config", {})
         password_pepper = password_config.get("pepper", password_pepper)
+    else:
+        print "Warning: no config file passed with -c flag on commandline. The pepper and bcrypt_rounds configuration options may not be what you expect"
+
     password = args.password
 
     if not password: