{"categories":[{"label":"Utilities","url":"https://skillfed.io/packages/category/utilities/8"}],"enrichment":{"capability":"Integrates password breach checking from the Pwned Passwords database into Django sites via a validator, middleware, and direct API client, using anonymized queries that never transmit full passwords.","skillfed_tags":["django-security","password-validation","breach-detection"],"use_cases":["Reject weak passwords during user registration or password reset by adding the validator to Django's AUTH_PASSWORD_VALIDATORS.","Automatically block login attempts using credentials known to be compromised, via the middleware layer.","Build custom password-strength workflows that query the Pwned Passwords database directly using the API client.","Implement multi-layer authentication security in Django admin or other sensitive areas by combining the validator and middleware.","Audit existing user passwords against breach records in background tasks using the async API client."],"what_it_does":"This package brings password breach detection to Django applications by querying the Have I Been Pwned Pwned Passwords database\u2014a large, curated collection of passwords compromised in known data breaches. It offers three integration points: a password validator that plugs into Django's built-in password validation system, middleware that automatically checks certain request payloads, and a direct API client for custom use cases. All queries use an anonymized, k-anonymity protocol that never sends full passwords or complete hashes to third parties, protecting user privacy while checking against breach records.\n\nThe package supports both synchronous and asynchronous Django request handling, making it suitable for modern async-capable Django projects. It requires Django 4.2 or later and Python 3.9 or later, and depends only on httpx for HTTP communication. The recommended setup is to enable both the validator and middleware together, creating a defense-in-depth approach: the validator rejects weak passwords at account creation or password-change time, while the middleware catches attempts to use compromised credentials in login or other sensitive requests.","worth_installing":"Yes, if you run a Django site and want to reject compromised passwords. The package is production-stable (Development Status 5), has low install friction, carries a permissive license, and has no known vulnerabilities. The aging maintenance status (last release 495 days ago) is a minor concern\u2014the code is stable and the underlying Pwned Passwords API is maintained externally\u2014but verify that the package still works with your Django and Python versions before deploying."},"id":"pwned-passwords-django","links":{"html":"https://skillfed.io/packages/pwned-passwords-django","md":"https://skillfed.io/packages/pwned-passwords-django.md","pypi":"https://pypi.org/project/pwned-passwords-django/"},"maintenance":{"status":"aging"},"meta":{"latest_release":"2025-04-06","license_spdx":null,"license_treatment":"permissive","name":"pwned-passwords-django","python_support":"supports_current","summary":"A Pwned Passwords implementation for Django sites."},"popularity":{"monthly_downloads":167675,"position":10465,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"5.2.0"}