django-password-policies-iplweb

A Django application that provides unicode-aware password policies on password changes and resets, along with a mechanism to force password changes.

Originally developed by Tarak Blah as django-password-policies. This fork is actively maintained by IPLweb.

Support graciously provided by

Why?

Django's built-in authentication provides basic password hashing and validation, but lacks enterprise-grade password policy enforcement — expiration, reuse prevention, forced rotation, and fine-grained complexity rules. This package fills that gap with a pluggable, configurable set of policies that integrate with Django's auth system.

Features

• Password expiration — automatically expire passwords after a configurable duration (default: 60 days)
• Forced password changes — redirect users to password change form via middleware, with admin bulk action support
• Password history — prevent reuse of the last N passwords (default: 10)
• 11 built-in validators — letter/number/symbol counts, consecutive character limits, common sequence detection, entropy checks, dictionary lookup, cracklib support, email rejection
• Password similarity check — Levenshtein distance comparison between old and new passwords
• Complete password change/reset views — six class-based views with customizable templates and URLs
• Django admin integration — admin panels for password history and forced change management
• 26 configurable settings — fine-tune every aspect of password policy enforcement
• Context processor — exposes password_change_required flag to templates
• Unicode-aware — full unicode support in password validation
• I18N ready — all user-facing messages use Django's translation framework

Supported versions

Django 6.x requires Python 3.12 or newer.

Django 5.0 and 5.1 are no longer covered by CI (both reached end of life upstream), but the package does not use any API removed in those series and the declared dependency is still django>=4.2, so they keep working.

Installation

Using uv (recommended)

uv add django-password-policies-iplweb

Using pip

pip install django-password-policies-iplweb

Quick start

Add to your Django settings:

INSTALLED_APPS = [
    ...
    "password_policies",
]

MIDDLEWARE = [
    ...
    "password_policies.middleware.PasswordChangeMiddleware",
]

TEMPLATES = [
    {
        ...
        "OPTIONS": {
            "context_processors": [
                ...
                "password_policies.context_processors.password_status",
            ],
        },
    },
]

Run migrations:

python manage.py migrate password_policies

Include URLs:

from django.urls import include, path

urlpatterns = [
    ...
    path("password/", include("password_policies.urls")),
]

Documentation

Full documentation is published at https://iplweb.github.io/django-password-policies-iplweb/ and rebuilt from develop on every push.

• Overview
• Setup
• Settings reference
• Writing custom validators

To build the docs locally:

uv sync --all-extras
uv run sphinx-build -b html docs docs/_build/html

License

BSD-3-Clause — see LICENSE for details.