django-zxcvbn-password-validator
A translatable password validator for django, based on zxcvbn-python.
Decision gist · record as of 2026-08-14
Yes. The package is actively maintained, has no known vulnerabilities, low install friction, and solves a real security problem—pattern-based strength estimation is more effective than rule-based validation. Use it if your Django project needs password validation and you want to guide users toward genuinely harder-to-crack passwords rather than arbitrary character rules.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low friction: pure Python wheel with only two runtime dependencies (django and zxcvbn).
- Actively maintained as of 2026-08-01 with recent release activity.
License · maintenance · safety
MIT (permissive) — MIT license (permissive) — you may use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.
last release 2026-06-14 (61 days) · last repo commit 2026-08-01 · 31 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 284,524 downloads/mo, #8,063 on PyPI
Alternatives
Verify before relying
pip install django-zxcvbn-password-validator
# In settings.py:
INSTALLED_APPS = [
"django_zxcvbn_password_validator"
]
AUTH_PASSWORD_VALIDATORS = [
{"NAME": "django_zxcvbn_password_validator.ZxcvbnPasswordValidator"},
]
PASSWORD_MINIMAL_STRENGTH = 2 # 0-4 scale- Whether get_strength() output fields (score, crack_time_seconds, etc.) remain stable across zxcvbn versions
- Performance impact of running zxcvbn on every password check in high-traffic applications
What it is and what it does
django-zxcvbn-password-validator integrates the zxcvbn password-strength estimator into Django's authentication system as a pluggable validator. Instead of enforcing rigid rules (minimum length, character types), it analyzes patterns, keyboard layouts, and common password dictionaries to estimate how long a password would take to crack offline. It then rejects passwords below a configurable strength threshold (0–4 scale) and provides actionable, translated feedback explaining what makes a password weak.
The package wraps zxcvbn's analysis in Django's validator interface and adds internationalization: error messages, warnings, and suggestions are translated to the active language. You can also supply a custom dictionary of terms (company names, product names) that should not appear in passwords. For use cases that need to inspect strength without raising an error—such as powering a live strength meter—the get_strength() method returns a dict with the score, estimated crack time, and suggestions without validation.
Use it for
- Replace Django's default password validators with strength estimation that adapts to user context and keyboard patterns
- Build a live password-strength meter that shows users real-time feedback as they type, using get_strength()
- Enforce stronger passwords in production while allowing weaker ones in development by toggling PASSWORD_MINIMAL_STRENGTH
- Prevent users from choosing passwords that resemble company or product names by adding them to PASSWORD_EXTRA_DICTIONARY
- Provide password feedback in languages other than English by leveraging the package's 131 language translations
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
The package is actively maintained, has no known vulnerabilities, low install friction, and solves a real security problem—pattern-based strength estimation is more effective than rule-based validation. Use it if your Django project needs password validation and you want to guide users toward genuinely harder-to-crack passwords rather than arbitrary character rules.
Install
django-zxcvbn-password-validator on PyPI
Before you install
Low friction: pure Python wheel with only two runtime dependencies (django and zxcvbn). Actively maintained as of 2026-08-01 with recent release activity.
License in practice
MIT license (permissive) — you may use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.
Quickstart
pip install django-zxcvbn-password-validator
# In settings.py:
INSTALLED_APPS = [
"django_zxcvbn_password_validator"
]
AUTH_PASSWORD_VALIDATORS = [
{"NAME": "django_zxcvbn_password_validator.ZxcvbnPasswordValidator"},
]
PASSWORD_MINIMAL_STRENGTH = 2 # 0-4 scaleVerify before relying
- Whether get_strength() output fields (score, crack_time_seconds, etc.) remain stable across zxcvbn versions
- Performance impact of running zxcvbn on every password check in high-traffic applications
Package facts
| License | MIT permissive |
| Python support | Supports the current Python release >=3.6.0 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 2 packagesdjangozxcvbn |
| Maintenance | Actively maintained 61 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 284,524 / month, #8,063 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableFramework :: DjangoFramework :: Django :: 3.2Framework :: Django :: 4.2Framework :: Django :: 5.2Framework :: Django :: 6.0Intended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseNatural Language :: AfrikaansNatural Language :: ArabicNatural Language :: ArmenianNatural Language :: BasqueNatural Language :: BengaliNatural Language :: BosnianNatural Language :: BulgarianNatural Language :: CantoneseNatural Language :: CatalanNatural Language :: Catalan (Valencian)Natural Language :: Chinese (Simplified)Natural Language :: Chinese (Traditional)Natural Language :: CroatianNatural Language :: CzechNatural Language :: DanishNatural Language :: DutchNatural Language :: EnglishNatural Language :: EsperantoNatural Language :: EstonianNatural Language :: FinnishNatural Language :: FrenchNatural Language :: GalicianNatural Language :: GeorgianNatural Language :: GermanNatural Language :: GreekNatural Language :: HebrewNatural Language :: HindiNatural Language :: HungarianNatural Language :: IcelandicNatural Language :: IndonesianNatural Language :: IrishNatural Language :: ItalianNatural Language :: JapaneseNatural Language :: JavaneseNatural Language :: KoreanNatural Language :: LatinNatural Language :: LatvianNatural Language :: LithuanianNatural Language :: MacedonianNatural Language :: MalayNatural Language :: MarathiNatural Language :: NepaliNatural Language :: NorwegianNatural Language :: PanjabiNatural Language :: PersianNatural Language :: PolishNatural Language :: PortugueseNatural Language :: Portuguese (Brazilian)Natural Language :: RomanianNatural Language :: RussianNatural Language :: SerbianNatural Language :: SlovakNatural Language :: SlovenianNatural Language :: SpanishNatural Language :: SwedishNatural Language :: TamilNatural Language :: TeluguNatural Language :: ThaiNatural Language :: TibetanNatural Language :: TurkishNatural Language :: UkrainianNatural Language :: UrduNatural Language :: VietnameseNatural Language :: YiddishOperating System :: OS IndependentProgramming Language :: Python :: 3 :: OnlyProgramming Language :: Python :: 3.10Programming Language :: Python :: 3.11Programming Language :: Python :: 3.12Programming Language :: Python :: 3.13Programming Language :: Python :: 3.14Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9 |
Evidence: django_zxcvbn_password_validator-1.7.0-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “django password strength validator”
- django-zxcvbn-password-validatorA Django password validator that uses pattern matching and dictionary…
- django-password-validatorsProvides additional password validators for Django that enforce…
- pwned-passwords-djangoIntegrates password breach checking from the Pwned Passwords database…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also zxcvbn · pwned-passwords-django · types-zxcvbn · django-password-validators · password-strength · gcld3 · xkcdpass · pyspellchecker · jieba