Registry / auth-security / pwned-passwords-django

pwned-passwords-django

library5.2.0pypypiunverified

A Django library to check passwords against the Have I Been Pwned Pwned Passwords database, either via k-Anonymity API or a local download of the hashed passwords. Version 5.2.0 requires Python >=3.9, compatible with Django 3.2+. It integrates seamlessly with Django's password validation framework and provides both online and offline modes.

auth-security web-framework aws

pip install pwned-passwords-django

github ↗package ↗docs ↗

INSTALL

IMPORT

SIG · PWNED-PASSWORDS-DJ

pwned-passwords-django

auth-securitypythonv5.2.0

Install

4.2s avg

Import

—

Disk

70MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v5.2.0 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.95 runs

installs and imports cleanly · install 0.0s · import 0.000s · 70MB

glibc

py 3.10–3.95 runs

installs and imports cleanly · install 4.2s · import 0.000s · 71MB

70MB installed

● package 70MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

pwned_password_validator

✓ from pwned_passwords_django.validators import pwned_password_validator

✗ from pwned_passwords_django.validators import pwned_password_validator

Basic setup: add app to INSTALLED_APPS, add the validator, and optionally configure API vs local mode.

# Add to INSTALLED_APPS: INSTALLED_APPS = [ ... 'pwned_passwords_django', ] # Add to AUTH_PASSWORD_VALIDATORS: AUTH_PASSWORD_VALIDATORS = [ ... { 'NAME': 'pwned_passwords_django.validators.pwned_password_validator', }, ] # Optional: configure settings in settings.py PWNED_PASSWORDS = { 'API_ENABLED': True, # or False to use local database }

Debug

Known issues

gotchaThe validator only works when the password is set via Django's set_password() which triggers validation. Direct assignment to the password field bypasses validation.

fix

Use set_password() or User.objects.create_user() to ensure validation runs.

affects: all

gotchaIf API_ENABLED is True (default), the validator makes an external API call to HIBP. This can cause performance issues in bulk operations or deny the service if misconfigured.

fix

Set PWNED_PASSWORDS['API_ENABLED'] = False and use a local database download for offline mode.

affects: all

breakingIn version 4.0.0, the package renamed from 'django-pwned-passwords' to 'pwned-passwords-django'. Import paths changed accordingly.

fix

Use the new package name: pip install pwned-passwords-django. Old import 'from pwned_passwords import ...' no longer works.

affects: >=4.0.0

Upgrade

Version history

5.2.0latest on PyPI · released Apr 6, 2025

Audit

Dependencies

DjangorequiredCore dependency; the library is a Django app.

requestsrequiredUsed for k-Anonymity API calls when online mode is enabled.

Agent activity

18 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/ubernostrum/pwned-passwords-django ↗

packagehttps://pypi.org/project/pwned-passwords-django/ ↗

docshttps://pwned-passwords-django.readthedocs.io/ ↗