---
id: django-hijack
version: "3.7.8"
license: unclear
license_treatment: permissive
maintenance: active
---

# django-hijack — Enable users to hijack (=login as) and work on behalf of another user.

License: permissive · Maintenance: active · Downloads: 2.1M/mo

## What it is and what it does

Django Hijack is an admin tool that allows authorized users (typically support staff or administrators) to impersonate other users within a Django application without requiring their passwords. It's designed to streamline user support workflows where staff need to reproduce issues or assist users by working in their account directly.

The package integrates with Django's admin interface and provides a security-first approach in its current v3.x release, which is a complete rewrite from earlier versions. It has a single runtime dependency on django and supports modern Python versions (3.10 through 3.14) and recent Django releases (4.2, 5.2, 6.0). The package is actively maintained and widely used in production environments.

Use it for:

- Support staff reproducing user-reported bugs by logging in as the affected user to see their exact experience
- Administrators troubleshooting account issues or permission problems without asking users for credentials
- Testing application behavior across different user roles and permission levels during development
- Assisting users with account recovery or configuration without requiring password resets

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Django Hijack lets administrators impersonate other users in a Django application, allowing support staff and admins to log in as another user without needing their password.

Yes, if you run a Django application with a support team or need admin user impersonation. The package is production-stable (Development Status 5), actively maintained, has no known vulnerabilities, and carries a permissive MIT license. Install friction is minimal. The only consideration is ensuring your security model accounts for the audit and logging implications of admin impersonation.

## Install

pip install django-hijack
uv add django-hijack
poetry add django-hijack

## Installing django-hijack

Before you install: Low install friction with a single runtime dependency on django. The package is actively maintained with a recent release (117 days ago) and a stable codebase (1740 stars, last commit 2026-08-11).

License in practice: MIT license (permissive) means you can use, modify, and distribute this package freely in both open-source and commercial projects with minimal restrictions.

Quickstart:

pip install django-hijack

# Add to Django INSTALLED_APPS
INSTALLED_APPS = [
    ...
    'hijack',
]

# Then use via Django admin or programmatically to impersonate users

Requires Django 4.2, 5.2, or 6.0 and Python 3.10 or later.

Verify before relying:

- Whether v3.x's 'security first design' has undergone independent security audit or formal threat modeling
- Specific details on how impersonation sessions are logged and audited for compliance purposes
- Whether dark-mode support is a UI feature or includes accessibility considerations

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.1M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django user impersonation, admin login as user, django hijack, user impersonation django, admin user switching, django support user access, impersonate user django, django-admin, user-impersonation, support-tools

[View on SkillFed](https://skillfed.io/packages/django-hijack) · [View on PyPI](https://pypi.org/project/django-hijack/)