srp
Secure Remote Password
Decision gist · record as of 2026-08-14
Yes, if you need SRP-based authentication and have verified that SRP meets your security requirements. The package is stable, has no known vulnerabilities, and installs easily with minimal dependencies. However, dormant maintenance (no releases in 651 days) means security updates or bug fixes may be slow; evaluate whether the protocol itself and this implementation align with your threat model before adopting it.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low friction installation with a single lightweight dependency (six).
- Maintenance is dormant—last commit was 2024-11-05 and no releases in 651 days—but the repository remains active and the package is marked Production/Stable.
License · maintenance · safety
MIT (permissive) — Licensed under MIT (permissive), so you can use, modify, and distribute the package freely in commercial or private projects with minimal restrictions.
last release 2024-11-01 (651 days) · last repo commit 2024-11-05 · 126 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 109,575 downloads/mo, #12,509 on PyPI
Alternatives
Verify before relying
pip install srp
import srp
# Create a user verifier and authentication session
user = srp.User(username, password)
verifier = user.get_verifier()
# Server and client exchange SRP messages to authenticate- Whether the package supports modern Python versions (requires_python is unspecified in the fact sheet)
- Whether SRP is suitable for contemporary security standards or if it has known limitations relative to modern alternatives
- Performance characteristics and typical use-case scale (e.g., throughput, latency)
What it is and what it does
SRP is a cryptographic authentication protocol that allows a client and server to verify each other's knowledge of a password without transmitting the password itself or relying on a trusted certificate authority. Unlike SSL/TLS or Kerberos, SRP derives server-side verification keys directly from user passwords, making it useful for systems where external infrastructure is unavailable or undesirable. The protocol provides mutual authentication—both sides must possess the correct password or key material for authentication to succeed—and produces a shared cryptographic key that can be used for subsequent symmetric encryption.
The srp package provides a Python implementation of this protocol. It depends only on six, making it lightweight and easy to integrate. The package is marked Production/Stable and has been in active development since 2011, though recent maintenance is minimal. It is suitable for applications that need password-based authentication without certificate management overhead, though you should verify that SRP meets your security and compatibility requirements before deploying it.
Use it for
- Authenticate users in a custom application without setting up a certificate authority or external key server
- Implement mutual authentication between a client and server over an untrusted network connection
- Derive a shared encryption key from a password for symmetric-key encryption of subsequent communication
- Build authentication systems for embedded or isolated environments where certificate infrastructure is impractical
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, if you need SRP-based authentication and have verified that SRP meets your security requirements.
The package is stable, has no known vulnerabilities, and installs easily with minimal dependencies. However, dormant maintenance (no releases in 651 days) means security updates or bug fixes may be slow; evaluate whether the protocol itself and this implementation align with your threat model before adopting it.
Install
srp on PyPI
Before you install
Low friction installation with a single lightweight dependency (six). Maintenance is dormant—last commit was 2024-11-05 and no releases in 651 days—but the repository remains active and the package is marked Production/Stable.
License in practice
Licensed under MIT (permissive), so you can use, modify, and distribute the package freely in commercial or private projects with minimal restrictions.
Quickstart
pip install srp
import srp
# Create a user verifier and authentication session
user = srp.User(username, password)
verifier = user.get_verifier()
# Server and client exchange SRP messages to authenticateVerify before relying
- Whether the package supports modern Python versions (requires_python is unspecified in the fact sheet)
- Whether SRP is suitable for contemporary security standards or if it has known limitations relative to modern alternatives
- Performance characteristics and typical use-case scale (e.g., throughput, latency)
Package facts
| License | MIT permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | 1 packagesix |
| Maintenance | Dormant 651 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 109,575 / month, #12,509 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: BSD LicenseOperating System :: OS IndependentProgramming Language :: PythonProgramming Language :: Python :: 3Topic :: Security |
Evidence: srp-1.0.22-py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “SRP authentication protocol”
- srpImplements the Secure Remote Password (SRP) protocol for…
- srptoolsImplements Secure Remote Password (SRP) protocol for…
- aa-srpaa-srp is a Django plugin for Alliance Auth that manages ship…
Give your agent the search over MCP, or paste the wish link into any chat.
More Security packages
Provides Python bindings to the FreeDesktop.org Secret Service API for securely storing and retrieving passwords and secrets through GNOME Keyring, KWallet, or KeePassXC.
MSAL for Python handles OAuth2 and OpenID Connect authentication with Microsoft identity services, managing token acquisition, caching, and refresh for applications integrating with Microsoft Entra ID, Microsoft Accounts, and Azure AD B2C.
joserfc implements JOSE standards (JWS, JWE, JWK, JWT, and related RFCs) for signing, encrypting, and managing JSON-based cryptographic tokens in Python.
Authlib provides a complete implementation of OAuth 1.0, OAuth 2.0, and OpenID Connect 1.0 for building both authentication clients and servers, with built-in support for JWS, JWK, JWA, and JWT standards.
Provides low-level CFFI bindings to the official Argon2 password hashing algorithm for use by libraries and applications that need direct access to Argon2 without higher-level abstractions.
ADAL for Python authenticates applications with Azure Active Directory to obtain tokens for accessing Azure AD-protected resources.
Install only if maintaining existing code that already depends on it, and plan a migration.
See also srptools · secure-smtplib · asyauth · pypsrp · service-identity · requests-kerberos · spake2 · snitun · requests-gssapi · acme