--- id: pwned-passwords-django version: "5.2.0" license: BSD-3-Clause license_treatment: permissive maintenance: aging --- # pwned-passwords-django — A Pwned Passwords implementation for Django sites. License: permissive · Maintenance: aging · Downloads: 167.7K/mo ## What it is and what it does This package brings password breach detection to Django applications by querying the Have I Been Pwned Pwned Passwords database—a large, curated collection of passwords compromised in known data breaches. It offers three integration points: a password validator that plugs into Django's built-in password validation system, middleware that automatically checks certain request payloads, and a direct API client for custom use cases. All queries use an anonymized, k-anonymity protocol that never sends full passwords or complete hashes to third parties, protecting user privacy while checking against breach records. The package supports both synchronous and asynchronous Django request handling, making it suitable for modern async-capable Django projects. It requires Django 4.2 or later and Python 3.9 or later, and depends only on httpx for HTTP communication. The recommended setup is to enable both the validator and middleware together, creating a defense-in-depth approach: the validator rejects weak passwords at account creation or password-change time, while the middleware catches attempts to use compromised credentials in login or other sensitive requests. Use it for: - Reject weak passwords during user registration or password reset by adding the validator to Django's AUTH_PASSWORD_VALIDATORS. - Automatically block login attempts using credentials known to be compromised, via the middleware layer. - Build custom password-strength workflows that query the Pwned Passwords database directly using the API client. - Implement multi-layer authentication security in Django admin or other sensitive areas by combining the validator and middleware. - Audit existing user passwords against breach records in background tasks using the async API client. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Integrates password breach checking from the Pwned Passwords database into Django sites via a validator, middleware, and direct API client, using anonymized queries that never transmit full passwords. Yes, if you run a Django site and want to reject compromised passwords. The package is production-stable (Development Status 5), has low install friction, carries a permissive license, and has no known vulnerabilities. The aging maintenance status (last release 495 days ago) is a minor concern—the code is stable and the underlying Pwned Passwords API is maintained externally—but verify that the package still works with your Django and Python versions before deploying. ## Install pip install pwned-passwords-django uv add pwned-passwords-django poetry add pwned-passwords-django ## Installing pwned-passwords-django Before you install: Low install friction with two straightforward runtime dependencies (Django and httpx). Maintenance status is aging—last commit was 2025-04-06 and the package has not had a release in 495 days, though the repository remains active and not archived. License in practice: BSD-3-Clause permissive license allows commercial and private use with minimal restrictions, requiring only preservation of copyright and license notices. Quickstart: pip install pwned-passwords-django # In Django settings.py: AUTH_PASSWORD_VALIDATORS = [ {"NAME": "pwned_passwords_django.validators.PwnedPasswordsValidator"}, ] MIDDLEWARE = [ "pwned_passwords_django.middleware.pwned_passwords_middleware", ] Requires Django 4.2 or later and Python 3.9 or later; the Pwned Passwords API is queried over the network, so internet connectivity is needed for password checks. Verify before relying: - Whether the 495-day gap since last release indicates the package is stable or no longer actively maintained. - Performance impact of middleware on request handling when checking against the Pwned Passwords API. - Whether async support in middleware and API client is production-ready. ## Package facts - License: BSD-3-Clause (permissive) - Python support: supports_current - Install friction: low - Maintenance: aging - Downloads: 167.7K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags django password breach validation, pwned passwords integration, django security password checker, have i been pwned django, password compromise detection, django auth password validator, breach database password check, django-security, password-validation, breach-detection [View on SkillFed](https://skillfed.io/packages/pwned-passwords-django) · [View on PyPI](https://pypi.org/project/pwned-passwords-django/)