django-password-validators

What it is and what it does

django-password-validators extends Django's built-in password validation framework with two main validators: UniquePasswordsValidator prevents users from reusing recent passwords (configurable history depth, with all hashes stored encrypted in the database), and PasswordCharacterValidator enforces minimum counts of specific character types (digits, letters, special characters, case variants) in new passwords.

The package integrates directly into Django's AUTH_PASSWORD_VALIDATORS setting and requires a database migration to track password history. It supports Python 3.7 through 3.12 and is classified as Production/Stable, though development has been dormant since mid-2024. No known vulnerabilities are recorded.

Use it for:

• Enforce password complexity rules (e.g., require 2 uppercase, 3 special chars) in Django admin or user registration.
• Prevent users from cycling through a small set of passwords by blocking reuse of the last N passwords.
• Meet compliance requirements (e.g., NIST, corporate policy) that mandate character-type diversity in passwords.
• Add password history auditing by storing encrypted hashes of all or recent user passwords in the database.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Provides additional password validators for Django that enforce character-type requirements and prevent password reuse within a configurable history window.

Yes, if you need password complexity or history validation beyond Django's defaults. The package is stable, has no vulnerabilities, and low install friction. However, dormant maintenance (no updates in 977 days) means you should verify compatibility with your Django version and be prepared to fork or patch if issues arise. Not necessary if Django's built-in validators meet your security requirements.

Install

django-password-validators on PyPI

pip install django-password-validators

uv add django-password-validators

poetry add django-password-validators

Installing django-password-validators

Before you install

Low friction: pure Python wheel with only django as a runtime dependency. Maintenance is dormant (last commit 2024-07-29, no updates in 977 days), but the package is marked Production/Stable and carries no known vulnerabilities.

License in practice

BSD permissive license means you can use, modify, and distribute this package freely in commercial and open-source projects with minimal restrictions.

Quickstart

pip install django-password-validators

# In settings.py:
INSTALLED_APPS = [
    'django_password_validators',
    'django_password_validators.password_history',
]

AUTH_PASSWORD_VALIDATORS = [
    {
        'NAME': 'django_password_validators.password_history.password_validation.UniquePasswordsValidator',
        'OPTIONS': {'last_passwords': 5}
    }
]

# Then: python manage.py migrate

Requires Django 3.2 or later and a database migration to store password history.

Verify before relying

• Whether the package works with Django versions after 4.1 (latest documented example is 4.1).
• Current test coverage and whether dormant status reflects lack of maintenance or stable maturity.

Package facts

Evidence: django_password_validators-1.7.3-py3-none-any.whl

Keywords: django, password, validator

Tags

More Security packages