---
id: zxcvbn
version: "4.5.0"
license: MIT
license_treatment: permissive
maintenance: active
---

# zxcvbn

License: permissive · Maintenance: active · Downloads: 5.8M/mo

## What it is and what it does

zxcvbn is a Python port of Dropbox's realistic password strength estimator. It analyzes a password against multiple pattern-matching techniques—dictionary words, common sequences, repeated characters, keyboard patterns—and returns a numeric score (0–4) along with specific feedback on weaknesses and estimated crack times under different attack scenarios (online throttled, online unthrottled, offline slow hashing, offline fast hashing). You can supply user-provided data like names or birthdates to be checked against the password, and optionally customize the maximum password length or add custom frequency dictionaries for additional languages or domain-specific word lists.

The package is recommended by the original Dropbox developers and is the most actively maintained Python implementation. It has no external runtime dependencies, making it straightforward to integrate into authentication systems, password validators, or user-facing password-creation interfaces. The library also exposes a command-line interface for scripting and testing.

Use it for:

- Validate user passwords during account creation or password-reset flows with real-time feedback on strength.
- Implement server-side password policy enforcement that rejects weak passwords before storing them.
- Display crack-time estimates to users to help them understand the security implications of their password choice.
- Add custom dictionaries to detect common passwords or phrases specific to your organization or language.
- Analyze password datasets to identify weak patterns and inform security training or policy updates.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Estimates password strength by analyzing patterns, common words, and user data, returning a score from 0 to 4 plus actionable feedback and crack-time estimates.

Yes. zxcvbn is a well-maintained, dependency-free library recommended by its original creators, with no known vulnerabilities, permissive licensing, and broad Python version support. Install it if you need realistic password strength estimation with actionable feedback rather than simple regex or entropy rules.

## Install

pip install zxcvbn
uv add zxcvbn
poetry add zxcvbn

## Installing zxcvbn

Before you install: Low install friction with no runtime dependencies. Actively maintained as of 2025-02-19 with recent commits and 715 repository stars; tested across Python 3.8–3.13.

License in practice: MIT license permits free use, modification, and distribution with minimal restrictions—suitable for both open-source and commercial projects.

Quickstart:

pip install zxcvbn

from zxcvbn import zxcvbn

results = zxcvbn('JohnSmith123', user_inputs=['John', 'Smith'])
print(results['score'], results['feedback'])

Verify before relying:

- Whether performance remains acceptable when max_length is set significantly above the default 72 in production environments

## Package facts

- License: MIT (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 5.8M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

password strength estimator, password security scoring, password quality checker, password entropy analysis, password crack time estimation, password feedback suggestions, password pattern detection, password-validation, security-scoring

[View on SkillFed](https://skillfed.io/packages/zxcvbn) · [View on PyPI](https://pypi.org/project/zxcvbn/)