zxcvbn

What it is and what it does

zxcvbn is a Python port of Dropbox's realistic password strength estimator. It analyzes a password against multiple pattern-matching techniques—dictionary words, common sequences, repeated characters, keyboard patterns—and returns a numeric score (0–4) along with specific feedback on weaknesses and estimated crack times under different attack scenarios (online throttled, online unthrottled, offline slow hashing, offline fast hashing). You can supply user-provided data like names or birthdates to be checked against the password, and optionally customize the maximum password length or add custom frequency dictionaries for additional languages or domain-specific word lists.

The package is recommended by the original Dropbox developers and is the most actively maintained Python implementation. It has no external runtime dependencies, making it straightforward to integrate into authentication systems, password validators, or user-facing password-creation interfaces. The library also exposes a command-line interface for scripting and testing.

Use it for:

• Validate user passwords during account creation or password-reset flows with real-time feedback on strength.
• Implement server-side password policy enforcement that rejects weak passwords before storing them.
• Display crack-time estimates to users to help them understand the security implications of their password choice.
• Add custom dictionaries to detect common passwords or phrases specific to your organization or language.
• Analyze password datasets to identify weak patterns and inform security training or policy updates.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Estimates password strength by analyzing patterns, common words, and user data, returning a score from 0 to 4 plus actionable feedback and crack-time estimates.

Yes. zxcvbn is a well-maintained, dependency-free library recommended by its original creators, with no known vulnerabilities, permissive licensing, and broad Python version support. Install it if you need realistic password strength estimation with actionable feedback rather than simple regex or entropy rules.

Install

zxcvbn on PyPI

pip install zxcvbn

uv add zxcvbn

poetry add zxcvbn

Installing zxcvbn

Before you install

Low install friction with no runtime dependencies. Actively maintained as of 2025-02-19 with recent commits and 715 repository stars; tested across Python 3.8–3.13.

License in practice

MIT license permits free use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart

pip install zxcvbn

from zxcvbn import zxcvbn

results = zxcvbn('JohnSmith123', user_inputs=['John', 'Smith'])
print(results['score'], results['feedback'])

Verify before relying

• Whether performance remains acceptable when max_length is set significantly above the default 72 in production environments

Package facts

Evidence: zxcvbn-4.5.0-py2.py3-none-any.whl

Keywords: zxcvbn, password, security

Tags

More Python Modules packages