itsdangerous

Safely pass data to untrusted environments and back.

itsdangerous Permissive license AGING ★ 3,128 v2.2.0 released 2024-04-16

Install

itsdangerous on PyPI

pip

pip install itsdangerous

uv

uv add itsdangerous

poetry

poetry add itsdangerous

Package facts

License	not declared (permissive)
Python support	supports the current Python release (>=3.8)
Install friction	low — pure-Python wheel
Runtime dependencies	none
Maintenance	aging — 849 days since the last release
Last repo commit	2025-06-14
First released	2011-06-24
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: itsdangerous-2.2.0-py3-none-any.whl

Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseOperating System :: OS IndependentProgramming Language :: PythonTyping :: Typed

About itsdangerous

from the package's own PyPI description — quoted content, verbatim

ItsDangerous

... so better sign this

Various helpers to pass data to untrusted environments and to get it back safe and sound. Data is cryptographically signed to ensure that a token has not been tampered with.

It's possible to customize how data is serialized. Data is compressed as needed. A timestamp can be added and verified automatically while loading a token.

A Simple Example

Here's how you could generate a token for transmitting a user's id and name between web requests.

from itsdangerous import URLSafeSerializer
auth_s = URLSafeSerializer("secret key", "auth")
token = auth_s.dumps({"id": 5, "name": "itsdangerous"})

print(token)
# eyJpZCI6NSwibmFtZSI6Iml0c2Rhbmdlcm91cyJ9.6YP6T0BaO67XP--9UzTrmurXSmg

data = auth_s.loads(token)
print(data["name"])
# itsdangerous

Donate

The Pallets organization develops and supports ItsDangerous and other popular packages. In order to grow the community of contributors and users, and allow the maintainers to devote more time to the projects, please donate today.

Read as markdown · JSON record · Source repository · Docs

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

ItsDangerous cryptographically signs data to create tamper-proof tokens for passing information to untrusted environments and verifying it hasn't been altered on return.

Low friction: pure Python wheel with no runtime dependencies. Maintenance is aging—last release was 849 days ago—but the repository remains active with a recent commit on 2025-06-14, suggesting stable rather than abandoned status.

Permissive BSD license allows commercial and private use with minimal restrictions, typical of Pallets projects.

Usage

pip install itsdangerous==2.2.0

from itsdangerous import URLSafeSerializer
auth_s = URLSafeSerializer("secret key", "auth")
token = auth_s.dumps({"id": 5, "name": "itsdangerous"})
data = auth_s.loads(token)

Requires Python 3.8 or later.

Verdict: Mature, well-maintained library from Pallets with zero known vulnerabilities and broad adoption (top 1000 PyPI). No runtime dependencies and permissive licensing make it a low-risk choice for token signing and data integrity. Aging release cadence is normal for stable, feature-complete projects.

Needs verification

Whether the 849-day gap since last release reflects intentional stability or reduced maintenance priority.
Performance characteristics or cryptographic strength guarantees for specific use cases.

cryptographic token signingdata integrity verificationsecure token generationtamper-proof serializationsigned data transmissionuntrusted environment data passingtoken validation library