password-strength

What it is and what it does

password-strength provides a PasswordPolicy object that lets you define and enforce password requirements—minimum length, required character types (uppercase, numbers, special characters), non-letter counts, and entropy bits. It also offers PasswordStats to analyze a password's complexity on a 0.00–0.99 scale, where 0.66 and above indicates a strong password. You create a policy once, then call .test() on candidate passwords to get back a list of failed tests, or use .strength() to get a numeric complexity score.

The package supports both rule-based validation ("must have 2 uppercase and 2 special characters") and entropy-based validation ("must have 30 entropy bits"), as well as a strength-score approach that accounts for character variety and alphabet size. It handles Unicode passwords, including international character sets.

Use it for:

• Enforce password requirements during user registration or password-change flows in a web application.
• Score and display real-time password strength feedback to users as they type a new password.
• Validate passwords against a corporate policy that requires specific character-type minimums.
• Analyze password entropy to ensure sufficient complexity without rigid character-type rules.
• Support multi-language password validation using Unicode character analysis.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Evaluates password strength and validates passwords against configurable policies using tests for length, character composition, entropy, and complexity scoring.

No. The package is abandoned (last updated 2019, repository archived) with no maintenance or security patches forthcoming. While it has low install friction and a permissive license, relying on unmaintained password validation code poses a security and compatibility risk. For new projects, use an actively maintained alternative; for legacy systems already using it, plan a migration.

Install

password-strength on PyPI

pip install password-strength

uv add password-strength

poetry add password-strength

Installing password-strength

Before you install

Low install friction with a single lightweight dependency (six). However, the package is abandoned—last release was in 2019 and the repository was archived after 2779 days without updates. No active maintenance or security patches should be expected.

License in practice

Licensed under BSD (permissive), which allows commercial and private use with minimal restrictions. No copyleft obligations.

Quickstart

from password_strength import PasswordPolicy

policy = PasswordPolicy.from_names(length=8, uppercase=2, numbers=2, special=2)
results = policy.test('ABcd12!@')
print(results)  # [] means password passes

Verify before relying

• Whether the package's password strength algorithm remains cryptographically sound by modern standards, given its age and lack of maintenance.
• Compatibility with current Python versions beyond the unspecified support declaration.

Package facts

Evidence: password_strength-0.0.3.post2-py2.py3-none-any.whl

Keywords: password, strength, policy, security

Tags

More Python Modules packages

Further reading