django-zxcvbn-password-validator 1.5.3

A translatable password validator for django, based on zxcvbn-python.

django-zxcvbn-password-validator

A translatable password validator for django, based on zxcvbn-python and available with pip.

Professional support for django-zxcvbn-password-validator is available as part of the Tidelift Subscription

Translating the project

This project is available in multiple language. Your contribution would be very appreciated if you know a language that is not yet available. See how to contribute

Language available

The software is developed in English. Other available languages are:

• Arabic thanks to Claude AI Assistant
• Armenian thanks to Claude AI Assistant
• Brazilian Portuguese thanks to Andrés Martano and Claude AI Assistant (corrections)
• Chinese Simplified thanks to Claude AI Assistant
• Czech thanks to Michal Čihař
• Dutch thanks to Thom Wiggers
• English
• French thanks to Pierre Sassoulas and Lionel Sausin
• German thanks to Claude AI Assistant
• Hausa thanks to Claude AI Assistant
• Hindi thanks to Claude AI Assistant
• Hungarian thanks to RViktor
• Indonesian thanks to Claude AI Assistant
• Italian thanks to Claude AI Assistant
• Japanese thanks to Claude AI Assistant
• Korean thanks to Claude AI Assistant
• Polish thanks to Claude AI Assistant
• Portuguese thanks to Claude AI Assistant
• Russian thanks to Claude AI Assistant
• Spanish thanks to Claude AI Assistant
• Swahili thanks to Claude AI Assistant
• Thai thanks to Claude AI Assistant
• Turkish thanks to Claude AI Assistant
• Ukrainian thanks to Claude AI Assistant
• Vietnamese thanks to Claude AI Assistant
• Yoruba thanks to Claude AI Assistant

Creating a user with django-zxcvbn-password-validator

If the password is not strong enough, we provide errors explaining what you need to do :

The error message are translated to your target language (even the string given by zxcvbn that are in english only) :

How to use

Add django-zxcvbn-password-validator to your requirements and get it with pip. Then everything happens in your settings file.

Add 'django_zxcvbn_password_validator' in the INSTALLED_APPS :

INSTALLED_APPS = [
    # ...
    "django_zxcvbn_password_validator"
]

Modify AUTH_PASSWORD_VALIDATORS :

AUTH_PASSWORD_VALIDATORS = [
    {
        "NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator",
    },
    {
        "NAME": "django_zxcvbn_password_validator.ZxcvbnPasswordValidator",
    },
    # ...
]

You could choose to use zxcvbn alone, but I personally still use Django's UserAttributeSimilarityValidator, because there seems to be still be some problem with it integrating user information with zxcvbn (as of june 2018).

Finally, you can set the PASSWORD_MINIMAL_STRENGTH to your liking (default is 2), every password scoring lower than this number will be rejected :

# 0 too guessable: risky password. (guesses < 10^3)
# 1 very guessable: protection from throttled online attacks.
# (guesses < 10^6)
# 2 somewhat guessable: protection from unthrottled online attacks.
# (guesses < 10^8)
# 3 safely unguessable: moderate protection from offline slow-hash scenario.
# (guesses < 10^10)
# 4 very unguessable: strong protection from offline slow-hash scenario.
# (guesses >= 10^10)
PASSWORD_MINIMAL_STRENGTH = 0 if DEBUG else 4