passlib

comprehensive password hashing framework supporting over 30 schemes

passlib Permissive license BSD Abandoned v1.7.4 released 2020-10-08

Install

passlib on PyPI

pip

pip install passlib

uv

uv add passlib

poetry

poetry add passlib

Package facts

License	BSD (permissive)
Python support	not specified
Install friction	low — pure-Python wheel
Runtime dependencies	none
Maintenance	abandoned — 2,135 days since the last release
First released	2011-03-25
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: passlib-1.7.4-py2.py3-none-any.whl

Keywords: password, secret, hash, security

About passlib

from the package's own PyPI description — quoted content, verbatim

Passlib is a password hashing library for Python 2 & 3, which provides cross-platform implementations of over 30 password hashing algorithms, as well as a framework for managing existing password hashes. It's designed to be useful for a wide range of tasks, from verifying a hash found in /etc/shadow, to providing full-strength password hashing for multi-user applications.

See the documentation <https://passlib.readthedocs.io>_ for details, installation instructions, and examples.
See the homepage <https://foss.heptapod.net/python-libs/passlib/wikis/home>_ for the latest news and more information.
See the changelog <https://passlib.readthedocs.io/en/stable/history>_ for a description of what's new in Passlib.

All releases are signed with the gpg key 4D8592DF4CE1ED31 <http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x4D8592DF4CE1ED31>_.

Read as markdown · JSON record · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Passlib provides cross-platform implementations of over 30 password hashing algorithms and a framework for managing password hashes, supporting tasks from verifying system shadow files to full-strength hashing for multi-user applications.

Installation is frictionless with no runtime dependencies, but the package has been abandoned since 2020-10-08 (2135 days ago), raising concerns about security patches and compatibility with current Python versions.

BSD permissive license allows broad use, modification, and distribution with minimal restrictions, suitable for both open-source and proprietary projects.

Usage

pip install passlib==1.7.4
from passlib.context import CryptContext
ctx = CryptContext(schemes=['bcrypt'])
hashed = ctx.hash('password')
ctx.verify('password', hashed)

Requires a working bcrypt or other hashing algorithm backend; passlib itself provides the interface but delegates to system or installed cryptographic libraries for actual hashing.

Verdict: Passlib remains a widely-used, dependency-free password hashing framework with permissive licensing, but its abandoned status since 2020-10-08 is a significant risk—no security updates and potential incompatibilities with modern systems. Use only in legacy systems or if you can actively maintain it.

Needs verification

Whether passlib 1.7.4 has been tested against Python 3.11, 3.12, or later versions
Known incompatibilities or security issues discovered post-2020-10-08 that may not be reflected in OSV
Whether the bcrypt or other algorithm backends have breaking changes since 2020-10-08

password hashing librarypassword hash verificationshadow file password checkingmulti-algorithm password frameworksecure password storage pythonpassword hash managementpassword hashing framework