scramp

An implementation of the SCRAM protocol.

scramp Permissive license MIT No Attribution Active v1.4.17 released 2026-08-07

Install

scramp on PyPI

pip

pip install scramp

uv

uv add scramp

poetry

poetry add scramp

Package facts

License	MIT No Attribution (permissive)
Python support	supports the current Python release (>=3.10)
Install friction	low — pure-Python wheel
Runtime dependencies	1 — asn1crypto
Maintenance	actively maintained — 6 days since the last release
First released	2019-02-10
Popularity	one of the top 1,000 most-downloaded packages on PyPI (30-day window, as of 2026-08-13)
Known vulnerabilities	none known (OSV.dev, checked 2026-08-13)

Evidence: scramp-1.4.17-py3-none-any.whl

Keywords: SASL, SCRAM, authentication

Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: MIT No Attribution License (MIT-0)Operating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: ImplementationProgramming Language :: Python :: Implementation :: CPython

About scramp

from the package's own PyPI description — quoted content, verbatim

Scramp

A Python implementation of the SCRAM authentication protocol. Scramp supports the following mechanisms:

SCRAM-SHA-1
SCRAM-SHA-1-PLUS
SCRAM-SHA-256
SCRAM-SHA-256-PLUS
SCRAM-SHA-512
SCRAM-SHA-512-PLUS
SCRAM-SHA3-512
SCRAM-SHA3-512-PLUS

Installation
Examples
Client and Server
Client only
Server only
Server Error
Standards
Missing tls-exporter channel binding support
API Docs
scramp.MECHANISMS
scramp.ScramClient
scramp.ScramMechanism
scramp.ScramServer
scramp.make_channel_binding(name, ssl_socket)
Testing
OpenSSF Scorecard
Doing A Release Of Scramp
Release Notes
[Version 1.4.17,...

Read as markdown · JSON record · Homepage

AI interpretation — verify before relying

AI-generated interpretation of the package facts above; every digit, version, license, or vulnerability id it cites is grounded in the facts already shown on this page

Scramp implements the SCRAM authentication protocol (SCRAM-SHA-1, SCRAM-SHA-256, SCRAM-SHA-512, and SCRAM-SHA3-512 variants) for both client and server roles in Python applications.

Installation is straightforward with low friction—a single pure-Python wheel with one runtime dependency (asn1crypto). The package is actively maintained with a release just 6 days ago and requires Python 3.10 or later.

Scramp is licensed under MIT No Attribution (MIT-0), a permissive license that allows unrestricted use, modification, and distribution with minimal obligations—no attribution required.

Usage

pip install scramp

from scramp import ScramClient
c = ScramClient(['SCRAM-SHA-256'], 'user', 'password')
cfirst = c.get_client_first()
# Send cfirst to server, receive server response, continue handshake

Requires Python 3.10 or later.

Verdict: Scramp is a well-maintained, actively developed SCRAM authentication library with low install friction, permissive licensing, and no known vulnerabilities. It is suitable for applications needing standards-compliant SCRAM authentication on both client and server sides.

Needs verification

Whether the package has formal security audit or OpenSSF scorecard details beyond the release notes mention
Performance characteristics and suitability for high-throughput authentication scenarios
Compatibility with specific SASL frameworks or messaging systems (e.g., AMQP, XMPP)

SCRAM authentication protocolSASL authentication client serverSHA-256 challenge response authpassword authentication mechanismSCRAM-SHA implementationsecure authentication protocolsalted challenge response