pwned-passwords-django

What it is and what it does

This package brings password breach detection to Django applications by querying the Have I Been Pwned Pwned Passwords database—a large, curated collection of passwords compromised in known data breaches. It offers three integration points: a password validator that plugs into Django's built-in password validation system, middleware that automatically checks certain request payloads, and a direct API client for custom use cases. All queries use an anonymized, k-anonymity protocol that never sends full passwords or complete hashes to third parties, protecting user privacy while checking against breach records.

The package supports both synchronous and asynchronous Django request handling, making it suitable for modern async-capable Django projects. It requires Django 4.2 or later and Python 3.9 or later, and depends only on httpx for HTTP communication. The recommended setup is to enable both the validator and middleware together, creating a defense-in-depth approach: the validator rejects weak passwords at account creation or password-change time, while the middleware catches attempts to use compromised credentials in login or other sensitive requests.

Use it for

• Reject weak passwords during user registration or password reset by adding the validator to Django's AUTH_PASSWORD_VALIDATORS.
• Automatically block login attempts using credentials known to be compromised, via the middleware layer.
• Build custom password-strength workflows that query the Pwned Passwords database directly using the API client.
• Implement multi-layer authentication security in Django admin or other sensitive areas by combining the validator and middleware.
• Audit existing user passwords against breach records in background tasks using the async API client.

Worth the install?

AI-flagged interpretation of the facts on this page. Verify before relying on it.

Install

pwned-passwords-django on PyPI

Before you install

Low install friction with two straightforward runtime dependencies (Django and httpx). Maintenance status is aging—last commit was 2025-04-06 and the package has not had a release in 495 days, though the repository remains active and not archived.

Requires Django 4.2 or later and Python 3.9 or later; the Pwned Passwords API is queried over the network, so internet connectivity is needed for password checks.

License in practice

BSD-3-Clause permissive license allows commercial and private use with minimal restrictions, requiring only preservation of copyright and license notices.

Quickstart

pip install pwned-passwords-django

# In Django settings.py:
AUTH_PASSWORD_VALIDATORS = [
    {"NAME": "pwned_passwords_django.validators.PwnedPasswordsValidator"},
]
MIDDLEWARE = [
    "pwned_passwords_django.middleware.pwned_passwords_middleware",
]

Package facts

Evidence: pwned_passwords_django-5.2.0-py3-none-any.whl

Tags

More Utilities packages

See also django-password-validators · django-zxcvbn-password-validator · django-otp · pwdlib · django-dirtyfields · django-registration · django-localflavor · django-constance · django-sesame · streamlit-authenticator