---
id: django-zxcvbn-password-validator
version: "1.7.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# django-zxcvbn-password-validator — A translatable password validator for django, based on zxcvbn-python.

License: permissive · Maintenance: active · Downloads: 284.5K/mo

## What it is and what it does

django-zxcvbn-password-validator integrates the zxcvbn password-strength estimator into Django's authentication system as a pluggable validator. Instead of enforcing rigid rules (minimum length, character types), it analyzes patterns, keyboard layouts, and common password dictionaries to estimate how long a password would take to crack offline. It then rejects passwords below a configurable strength threshold (0–4 scale) and provides actionable, translated feedback explaining what makes a password weak.

The package wraps zxcvbn's analysis in Django's validator interface and adds internationalization: error messages, warnings, and suggestions are translated to the active language. You can also supply a custom dictionary of terms (company names, product names) that should not appear in passwords. For use cases that need to inspect strength without raising an error—such as powering a live strength meter—the get_strength() method returns a dict with the score, estimated crack time, and suggestions without validation.

Use it for:

- Replace Django's default password validators with strength estimation that adapts to user context and keyboard patterns
- Build a live password-strength meter that shows users real-time feedback as they type, using get_strength()
- Enforce stronger passwords in production while allowing weaker ones in development by toggling PASSWORD_MINIMAL_STRENGTH
- Prevent users from choosing passwords that resemble company or product names by adding them to PASSWORD_EXTRA_DICTIONARY
- Provide password feedback in languages other than English by leveraging the package's 131 language translations

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

A Django password validator that uses pattern matching and dictionary analysis (via zxcvbn) to estimate actual password strength instead of applying fixed rules, and provides translatable feedback to guide users toward stronger passwords.

Yes. The package is actively maintained, has no known vulnerabilities, low install friction, and solves a real security problem—pattern-based strength estimation is more effective than rule-based validation. Use it if your Django project needs password validation and you want to guide users toward genuinely harder-to-crack passwords rather than arbitrary character rules.

## Install

pip install django-zxcvbn-password-validator
uv add django-zxcvbn-password-validator
poetry add django-zxcvbn-password-validator

## Installing django-zxcvbn-password-validator

Before you install: Low friction: pure Python wheel with only two runtime dependencies (django and zxcvbn). Actively maintained as of 2026-08-01 with recent release activity.

License in practice: MIT license (permissive) — you may use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install django-zxcvbn-password-validator

# In settings.py:
INSTALLED_APPS = [
    "django_zxcvbn_password_validator"
]

AUTH_PASSWORD_VALIDATORS = [
    {"NAME": "django_zxcvbn_password_validator.ZxcvbnPasswordValidator"},
]

PASSWORD_MINIMAL_STRENGTH = 2  # 0-4 scale

Verify before relying:

- Whether get_strength() output fields (score, crack_time_seconds, etc.) remain stable across zxcvbn versions
- Performance impact of running zxcvbn on every password check in high-traffic applications

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 284.5K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

django password strength validator, zxcvbn password validation, pattern-based password checker, translatable password feedback, django auth password validator, password strength estimation, keyboard layout password analysis, password-validation, django-auth, i18n

[View on SkillFed](https://skillfed.io/packages/django-zxcvbn-password-validator) · [View on PyPI](https://pypi.org/project/django-zxcvbn-password-validator/)