diff --git a/DEVELOPERS b/DEVELOPERS
index 69e73636be..a631c32405 100644
--- a/DEVELOPERS
+++ b/DEVELOPERS
@@ -1695,6 +1695,7 @@ F:	package/python-distro/
 F:	package/python-gnupg/
 F:	package/python-hkdf/
 F:	package/python-pyalsa/
+F:	package/python-spake2/
 F:	package/rdma-core/
 F:	package/riscv-isa-sim/
 F:	package/tinycompress/
@@ -1703,6 +1704,7 @@ F:	package/zynaddsubfx/
 F:	support/testing/tests/package/sample_python_distro.py
 F:	support/testing/tests/package/sample_python_gnupg.py
 F:	support/testing/tests/package/sample_python_pyalsa.py
+F:	support/testing/tests/package/sample_python_spake2.py
 F:	support/testing/tests/package/test_hwloc.py
 F:	support/testing/tests/package/test_ncdu.py
 F:	support/testing/tests/package/test_octave.py
@@ -1713,6 +1715,7 @@ F:	support/testing/tests/package/test_python_distro.py
 F:	support/testing/tests/package/test_python_hkdf.py
 F:	support/testing/tests/package/test_python_gnupg.py
 F:	support/testing/tests/package/test_python_pyalsa.py
+F:	support/testing/tests/package/test_python_spake2.py
 F:	support/testing/tests/package/test_rdma_core.py
 F:	support/testing/tests/package/test_rdma_core/
 F:	support/testing/tests/package/test_z3.py
diff --git a/package/Config.in b/package/Config.in
index b28949500e..ec7a6483f6 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -1290,6 +1290,7 @@ menu "External python modules"
 	source "package/python-sockjs/Config.in"
 	source "package/python-sortedcontainers/Config.in"
 	source "package/python-soupsieve/Config.in"
+	source "package/python-spake2/Config.in"
 	source "package/python-spidev/Config.in"
 	source "package/python-sqlalchemy/Config.in"
 	source "package/python-sqliteschema/Config.in"
diff --git a/package/python-spake2/Config.in b/package/python-spake2/Config.in
new file mode 100644
index 0000000000..1c2e3a49af
--- /dev/null
+++ b/package/python-spake2/Config.in
@@ -0,0 +1,13 @@
+config BR2_PACKAGE_PYTHON_SPAKE2
+	bool "python-spake2"
+	select BR2_PACKAGE_PYTHON_HKDF # runtime
+	help
+	  SPAKE2 password-authenticated key exchange (in pure python).
+
+	  This library implements the SPAKE2 password-authenticated
+	  key exchange ("PAKE") algorithm. This allows two parties,
+	  who share a weak password, to safely derive a strong shared
+	  secret (and therefore build an encrypted+authenticated
+	  channel).
+
+	  https://github.com/warner/python-spake2
diff --git a/package/python-spake2/python-spake2.hash b/package/python-spake2/python-spake2.hash
new file mode 100644
index 0000000000..30052b1b36
--- /dev/null
+++ b/package/python-spake2/python-spake2.hash
@@ -0,0 +1,5 @@
+# md5, sha256 from https://pypi.org/pypi/spake2/json
+md5  0155bad518bb49c39994fe0b7d9fb32c  spake2-0.8.tar.gz
+sha256  c17a614b29ee4126206e22181f70a406c618d3c6c62ca6d6779bce95e9c926f4  spake2-0.8.tar.gz
+# Locally computed sha256 checksums
+sha256  2a8a1200c3a2769d1815727f3b4439bd800f3bc88163118a36ff30b007d30031  LICENSE
diff --git a/package/python-spake2/python-spake2.mk b/package/python-spake2/python-spake2.mk
new file mode 100644
index 0000000000..99ce7dae13
--- /dev/null
+++ b/package/python-spake2/python-spake2.mk
@@ -0,0 +1,14 @@
+################################################################################
+#
+# python-spake2
+#
+################################################################################
+
+PYTHON_SPAKE2_VERSION = 0.8
+PYTHON_SPAKE2_SOURCE = spake2-$(PYTHON_SPAKE2_VERSION).tar.gz
+PYTHON_SPAKE2_SITE = https://files.pythonhosted.org/packages/60/0b/bb5eca8e18c38a10b1c207bbe6103df091e5cf7b3e5fdc0efbcad7b85b60
+PYTHON_SPAKE2_SETUP_TYPE = setuptools
+PYTHON_SPAKE2_LICENSE = MIT
+PYTHON_SPAKE2_LICENSE_FILES = LICENSE
+
+$(eval $(python-package))
diff --git a/support/testing/tests/package/sample_python_spake2.py b/support/testing/tests/package/sample_python_spake2.py
new file mode 100644
index 0000000000..49dd914ca8
--- /dev/null
+++ b/support/testing/tests/package/sample_python_spake2.py
@@ -0,0 +1,22 @@
+from binascii import hexlify
+
+from spake2 import SPAKE2_A, SPAKE2_B
+
+
+shared_password = b"This Is The Password!"
+
+alice = SPAKE2_A(shared_password)
+alice_msg = alice.start()
+
+bob = SPAKE2_B(shared_password)
+bob_msg = bob.start()
+
+# Alice and Bob exchange their messages...
+
+alice_key = alice.finish(bob_msg)
+bob_key = bob.finish(alice_msg)
+
+print("alice_key:", hexlify(alice_key))
+print("  bob_key:", hexlify(bob_key))
+
+assert alice_key == bob_key
diff --git a/support/testing/tests/package/test_python_spake2.py b/support/testing/tests/package/test_python_spake2.py
new file mode 100644
index 0000000000..fb47a0802c
--- /dev/null
+++ b/support/testing/tests/package/test_python_spake2.py
@@ -0,0 +1,11 @@
+from tests.package.test_python import TestPythonPackageBase
+
+
+class TestPythonPy3Spake2(TestPythonPackageBase):
+    __test__ = True
+    config = TestPythonPackageBase.config + \
+        """
+        BR2_PACKAGE_PYTHON3=y
+        BR2_PACKAGE_PYTHON_SPAKE2=y
+        """
+    sample_scripts = ["tests/package/sample_python_spake2.py"]