django-zxcvbn-password-validator

What it is and what it does

django-zxcvbn-password-validator integrates the zxcvbn password-strength estimator into Django's authentication system as a pluggable validator. Instead of enforcing rigid rules (minimum length, character types), it analyzes patterns, keyboard layouts, and common password dictionaries to estimate how long a password would take to crack offline. It then rejects passwords below a configurable strength threshold (0–4 scale) and provides actionable, translated feedback explaining what makes a password weak.

The package wraps zxcvbn's analysis in Django's validator interface and adds internationalization: error messages, warnings, and suggestions are translated to the active language. You can also supply a custom dictionary of terms (company names, product names) that should not appear in passwords. For use cases that need to inspect strength without raising an error—such as powering a live strength meter—the get_strength() method returns a dict with the score, estimated crack time, and suggestions without validation.

Use it for:

• Replace Django's default password validators with strength estimation that adapts to user context and keyboard patterns
• Build a live password-strength meter that shows users real-time feedback as they type, using get_strength()
• Enforce stronger passwords in production while allowing weaker ones in development by toggling PASSWORD_MINIMAL_STRENGTH
• Prevent users from choosing passwords that resemble company or product names by adding them to PASSWORD_EXTRA_DICTIONARY
• Provide password feedback in languages other than English by leveraging the package's 131 language translations

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

A Django password validator that uses pattern matching and dictionary analysis (via zxcvbn) to estimate actual password strength instead of applying fixed rules, and provides translatable feedback to guide users toward stronger passwords.

Yes. The package is actively maintained, has no known vulnerabilities, low install friction, and solves a real security problem—pattern-based strength estimation is more effective than rule-based validation. Use it if your Django project needs password validation and you want to guide users toward genuinely harder-to-crack passwords rather than arbitrary character rules.

Install

django-zxcvbn-password-validator on PyPI

pip install django-zxcvbn-password-validator

uv add django-zxcvbn-password-validator

poetry add django-zxcvbn-password-validator

Installing django-zxcvbn-password-validator

Before you install

Low friction: pure Python wheel with only two runtime dependencies (django and zxcvbn). Actively maintained as of 2026-08-01 with recent release activity.

License in practice

MIT license (permissive) — you may use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart

pip install django-zxcvbn-password-validator

# In settings.py:
INSTALLED_APPS = [
    "django_zxcvbn_password_validator"
]

AUTH_PASSWORD_VALIDATORS = [
    {"NAME": "django_zxcvbn_password_validator.ZxcvbnPasswordValidator"},
]

PASSWORD_MINIMAL_STRENGTH = 2  # 0-4 scale

Verify before relying

• Whether get_strength() output fields (score, crack_time_seconds, etc.) remain stable across zxcvbn versions
• Performance impact of running zxcvbn on every password check in high-traffic applications

Package facts

Evidence: django_zxcvbn_password_validator-1.7.0-py3-none-any.whl

Keywords: django, password-validator, zxcvbn

Tags

More Security packages