Flask-Security-Too
Quickly add security features to your Flask application.
Decision gist · record as of 2026-08-14
Yes. This is an actively maintained, permissively licensed extension backed by the Pallets organization (which maintains Flask itself). It has no known vulnerabilities, low install friction, and provides a comprehensive, opinionated security layer that would otherwise require integrating multiple smaller packages. Install it if you need user authentication and authorization in a Flask app and want to avoid the complexity of assembling and maintaining a custom solution.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Requires Python 3.10 or later.
- Needs a Flask application instance and a database setup (typically SQLAlchemy) to define User and Role models.
- Low install friction with a pure-Python wheel distribution.
License · maintenance · safety
permissive license (permissive) — MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.
last release 2026-08-12 (2 days) · last repo commit 2026-08-12 · 698 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 269,164 downloads/mo, #8,264 on PyPI
Alternatives
Verify before relying
pip install Flask-Security-Too
from flask import Flask
from flask_security import Security, SQLAlchemyUserDatastore
app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'
# Configure datastore with your user and role models
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)- Whether all advertised authentication methods (OAuth, WebAuthn, SMS/email MFA, passkeys) are production-ready in version 5.8.2 or still experimental.
- Performance characteristics and scalability limits when handling large numbers of concurrent authentication requests.
- Specific OWASP ASVS requirements that are enforced by default vs. those requiring explicit configuration.
What it is and what it does
Flask-Security-Too is a Flask extension that bundles authentication, authorization, and user management into a single package. It provides role-based access control, multiple authentication strategies (username/email, OAuth, WebAuthn), multi-factor authentication (SMS, email, authenticator apps), and session management. The package is maintained as part of the Pallets Community Ecosystem and aims to follow OWASP best practices with sensible defaults, reducing the need to wire together multiple abandoned or unmaintained projects.
You configure it by providing your own User and Role models (typically via SQLAlchemy) and then instantiate the Security object with your Flask app and a datastore. It handles login forms, password hashing, permission decorators, and token-based authentication out of the box. The extension supports modern identity patterns like unified signin (username, phone, passwordless) and freshness checks for sensitive operations.
Use it for
- Build a web application with user registration, login, and role-based access control without writing authentication logic from scratch.
- Add OAuth social login (via authlib) to an existing Flask app to let users sign in with third-party providers.
- Implement multi-factor authentication (SMS, email, or authenticator apps) for applications handling sensitive data.
- Deploy WebAuthn/passkey support for passwordless authentication in modern web applications.
- Enforce permission checks on Flask routes using decorators to restrict access by role or permission.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes.
This is an actively maintained, permissively licensed extension backed by the Pallets organization (which maintains Flask itself). It has no known vulnerabilities, low install friction, and provides a comprehensive, opinionated security layer that would otherwise require integrating multiple smaller packages. Install it if you need user authentication and authorization in a Flask app and want to avoid the complexity of assembling and maintaining a custom solution.
Install
flask-security-too on PyPI
Before you install
Low install friction with a pure-Python wheel distribution. Active maintenance with a release just 2 days old and commits as recent as 2026-08-12. Part of the Pallets Community Ecosystem, which maintains Flask itself, providing institutional backing and alignment with Flask's release and documentation standards.
Requires Python 3.10 or later. Needs a Flask application instance and a database setup (typically SQLAlchemy) to define User and Role models.
License in practice
MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.
Quickstart
pip install Flask-Security-Too
from flask import Flask
from flask_security import Security, SQLAlchemyUserDatastore
app = Flask(__name__)
app.config['SECRET_KEY'] = 'your-secret-key'
# Configure datastore with your user and role models
user_datastore = SQLAlchemyUserDatastore(db, User, Role)
security = Security(app, user_datastore)Verify before relying
- Whether all advertised authentication methods (OAuth, WebAuthn, SMS/email MFA, passkeys) are production-ready in version 5.8.2 or still experimental.
- Performance characteristics and scalability limits when handling large numbers of concurrent authentication requests.
- Specific OWASP ASVS requirements that are enforced by default vs. those requiring explicit configuration.
Package facts
| License | permissive license permissive |
| Python support | Supports the current Python release >=3.10 |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 8 packagesFlaskFlask-LoginFlask-PrincipalFlask-WTFemail-validatormarkupsafelibpasswtforms |
| Maintenance | Actively maintained 2 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 269,164 / month, #8,264 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableEnvironment :: Web EnvironmentFramework :: FlaskIntended Audience :: DevelopersLicense :: OSI Approved :: MIT LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: Implementation :: CPythonProgramming Language :: Python :: Implementation :: PyPyTopic :: Internet :: WWW/HTTP :: Dynamic ContentTopic :: Software Development :: Libraries :: Python Modules |
Evidence: flask_security_too-5.8.2-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “flask authentication library”
- Flask-Security-TooAdds user authentication, authorization, and role-based access…
- flask-oidcAdds OpenID Connect authentication support to Flask applications,…
- Flask-BcryptFlask-Bcrypt wraps the bcrypt password-hashing library for use in…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also Flask-Principal · Flask-Security · Flask-Session · flask-appbuilder · django-otp-webauthn · flask-oidc · Flask-Dance · Flask-OAuthlib · Flask-WTF · Flask-Mail