--- id: password-strength version: "0.0.3.post2" license: BSD license_treatment: permissive maintenance: abandoned --- # password-strength — Password strength and validation License: permissive · Maintenance: abandoned · Downloads: 201.9K/mo ## What it is and what it does password-strength provides a PasswordPolicy object that lets you define and enforce password requirements—minimum length, required character types (uppercase, numbers, special characters), non-letter counts, and entropy bits. It also offers PasswordStats to analyze a password's complexity on a 0.00–0.99 scale, where 0.66 and above indicates a strong password. You create a policy once, then call .test() on candidate passwords to get back a list of failed tests, or use .strength() to get a numeric complexity score. The package supports both rule-based validation ("must have 2 uppercase and 2 special characters") and entropy-based validation ("must have 30 entropy bits"), as well as a strength-score approach that accounts for character variety and alphabet size. It handles Unicode passwords, including international character sets. Use it for: - Enforce password requirements during user registration or password-change flows in a web application. - Score and display real-time password strength feedback to users as they type a new password. - Validate passwords against a corporate policy that requires specific character-type minimums. - Analyze password entropy to ensure sufficient complexity without rigid character-type rules. - Support multi-language password validation using Unicode character analysis. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Evaluates password strength and validates passwords against configurable policies using tests for length, character composition, entropy, and complexity scoring. No. The package is abandoned (last updated 2019, repository archived) with no maintenance or security patches forthcoming. While it has low install friction and a permissive license, relying on unmaintained password validation code poses a security and compatibility risk. For new projects, use an actively maintained alternative; for legacy systems already using it, plan a migration. ## Install pip install password-strength uv add password-strength poetry add password-strength ## Installing password-strength Before you install: Low install friction with a single lightweight dependency (six). However, the package is abandoned—last release was in 2019 and the repository was archived after 2779 days without updates. No active maintenance or security patches should be expected. License in practice: Licensed under BSD (permissive), which allows commercial and private use with minimal restrictions. No copyleft obligations. Quickstart: from password_strength import PasswordPolicy policy = PasswordPolicy.from_names(length=8, uppercase=2, numbers=2, special=2) results = policy.test('ABcd12!@') print(results) # [] means password passes Verify before relying: - Whether the package's password strength algorithm remains cryptographically sound by modern standards, given its age and lack of maintenance. - Compatibility with current Python versions beyond the unspecified support declaration. ## Package facts - License: BSD (permissive) - Python support: unspecified - Install friction: low - Maintenance: abandoned - Downloads: 201.9K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags password strength validation, password policy enforcement, password complexity checker, entropy-based password testing, password security scoring, password requirement rules, password strength meter, password-validation, abandoned [View on SkillFed](https://skillfed.io/packages/password-strength) · [View on PyPI](https://pypi.org/project/password-strength/)