Install & Compatibility
Where this runs
tested against v4.5.0.20260518 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.940 runs
installs and imports cleanly · install 0.0s · import 0.107s · 19.5MB
glibcpy 3.10–3.940 runs
installs and imports cleanly · install 1.7s · import 0.096s · 20MB
17MB installed
● package 17MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
zxcvbn
✓ from zxcvbn import zxcvbn
✗ import zxcvbn; zxcvbn.password_strength('test')
The primary callable is named `zxcvbn` within the `zxcvbn` module itself. Older forks or versions might use `password_strength`.
This quickstart demonstrates how to import the `zxcvbn` function and use it to evaluate a password's strength, providing user inputs to penalize common personal information. The results dictionary contains detailed information, including a score, crack time estimates, and feedback.
from zxcvbn import zxcvbn
password = 'correct horse battery staple'
user_inputs = ['correct', 'horse', 'battery', 'staple']
# Evaluate password strength
results = zxcvbn(password, user_inputs=user_inputs)
print(f"Password: {results['password']}")
print(f"Score: {results['score']}/4 (0=terrible, 4=great)")
print(f"Feedback: {results['feedback']['suggestions']}")
print(f"Estimated crack time: {results['crack_times_display']['online_no_throttling_10_per_second']}")
Debug
Known issues
gotchaInstalling `types-zxcvbn` alone only provides type hints for static analysis; it does NOT install the actual runtime `zxcvbn` library. You must install `zxcvbn` separately (e.g., `pip install zxcvbn`) for your code to run successfully.fixAlways ensure both `zxcvbn` and `types-zxcvbn` are installed: `pip install zxcvbn types-zxcvbn`.
affects: All versions
breakingType checking failures may occur if the version of `types-zxcvbn` does not accurately match the version of the `zxcvbn` runtime library you are using. `types-zxcvbn` aims to provide annotations for `zxcvbn==4.5.*`.fixAlign the major and minor versions of `types-zxcvbn` with your `zxcvbn` installation. For example, if you use `zxcvbn>=4.5.0,<4.6`, use `types-zxcvbn>=4.5.0,<4.6`.
affects: All versions
gotchaThere are multiple Python implementations/forks of `zxcvbn`, some of which are deprecated or unmaintained (e.g., `dropbox/python-zxcvbn`). The currently recommended and most up-to-date Python port is `dwolfhub/zxcvbn-python` (which corresponds to the `zxcvbn` package on PyPI).fixAlways install the `zxcvbn` package from PyPI (`pip install zxcvbn`) to ensure you are using the maintained version compatible with these type stubs. Avoid installing directly from old GitHub repositories unless you understand the implications.
affects: All versions
gotchaUsing the `max_length` parameter in the `zxcvbn` runtime library with values greater than 72 can lead to significantly longer processing times. This can potentially expose server-side applications to denial-of-service (DoS) scenarios.fixAvoid setting `max_length` greater than 72. Consider truncating input passwords before passing them to `zxcvbn` if extremely long passwords are not expected or if performance is critical. Check the `zxcvbn` library's documentation for the latest recommendations.
affects: zxcvbn 4.5.0 and earlier (runtime library)
Upgrade
Version history
4.5.0.20260518latest on PyPI · released May 18, 2026
Audit
Dependencies
zxcvbnrequiredThis package provides type stubs for the 'zxcvbn' runtime library. The 'zxcvbn' library itself must be installed to use the functionality at runtime.