diff --git a/.gitignore b/.gitignore
index 4d9c11accc..1671ae366d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,7 +18,6 @@ coverage/
 /zproject/dev-secrets.conf
 static/js/bundle.js
 static/third/gemoji
-static/third/zxcvbn/
 static/locale/language_options.json
 /node_modules
 npm-debug.log
diff --git a/docs/dev-setup-non-vagrant.md b/docs/dev-setup-non-vagrant.md
index d35cf1a993..5764d668ff 100644
--- a/docs/dev-setup-non-vagrant.md
+++ b/docs/dev-setup-non-vagrant.md
@@ -318,7 +318,6 @@ Now run these commands:
 
 ```
 ./tools/install-mypy
-./tools/setup/download-zxcvbn
 ./tools/setup/emoji_dump/build_emoji
 ./scripts/setup/generate_secrets.py --development
 if [ $(uname) = "OpenBSD" ]; then sudo cp ./puppet/zulip/files/postgresql/zulip_english.stop /var/postgresql/tsearch_data/; else sudo cp ./puppet/zulip/files/postgresql/zulip_english.stop /usr/share/postgresql/9.*/tsearch_data/; fi
diff --git a/package.json b/package.json
index bd2e49fe7f..b1a039125e 100644
--- a/package.json
+++ b/package.json
@@ -15,7 +15,8 @@
     "jquery": "1.12.1",
     "jquery-validation": "1.15.1",
     "sockjs-client":"1.1.1",
-    "webpack": "1.12.2"
+    "webpack": "1.12.2",
+    "zxcvbn": "4.4.1"
   },
   "devDependencies": {
     "casperjs": "1.1.3",
diff --git a/static/js/settings.js b/static/js/settings.js
index fb4b5a0f53..0326c41857 100644
--- a/static/js/settings.js
+++ b/static/js/settings.js
@@ -187,7 +187,7 @@ function _setup_page() {
         if (page_params.password_auth_enabled !== false) {
             // zxcvbn.js is pretty big, and is only needed on password
             // change, so load it asynchronously.
-            $.getScript('/static/third/zxcvbn/zxcvbn.js', function () {
+            $.getScript('/static/node_modules/zxcvbn/dist/zxcvbn.js', function () {
                 $('#pw_strength .bar').removeClass("fade");
             });
         }
diff --git a/templates/zerver/register.html b/templates/zerver/register.html
index dbb944ea72..d98a48813c 100644
--- a/templates/zerver/register.html
+++ b/templates/zerver/register.html
@@ -8,7 +8,7 @@ Form is validated both client-side using jquery-validate (see signup.js) and ser
 
 {% block customhead %}
 {{ super() }}
-<script type="text/javascript" src="/static/third/zxcvbn/zxcvbn.js"></script>
+<script type="text/javascript" src="/static/node_modules/zxcvbn/dist/zxcvbn.js"></script>
 {% endblock %}
 
 {% block portico_content %}
diff --git a/templates/zerver/reset_confirm.html b/templates/zerver/reset_confirm.html
index 0965be70b7..d6aa47040b 100644
--- a/templates/zerver/reset_confirm.html
+++ b/templates/zerver/reset_confirm.html
@@ -1,7 +1,7 @@
 {% extends "zerver/portico_signup.html" %}
 {% block customhead %}
 {{ super() }}
-<script type="text/javascript" src="/static/third/zxcvbn/zxcvbn.js"></script>
+<script type="text/javascript" src="/static/node_modules/zxcvbn/dist/zxcvbn.js"></script>
 {% endblock %}
 
 {% block portico_content %}
diff --git a/tools/provision.py b/tools/provision.py
index 4ab332ea7c..f6545b190a 100755
--- a/tools/provision.py
+++ b/tools/provision.py
@@ -202,7 +202,6 @@ def main(options):
     # create linecoverage directory`var/node-coverage`
     run(["mkdir", "-p", NODE_TEST_COVERAGE_DIR_PATH])
 
-    run(["tools/setup/download-zxcvbn"])
     if not os.path.isdir(EMOJI_CACHE_PATH):
         run(["sudo", "mkdir", EMOJI_CACHE_PATH])
     run(["sudo", "chown", "%s:%s" % (user_id, user_id), EMOJI_CACHE_PATH])
diff --git a/tools/setup/download-zxcvbn b/tools/setup/download-zxcvbn
deleted file mode 100755
index dd76a4f8b5..0000000000
--- a/tools/setup/download-zxcvbn
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/usr/bin/env bash
-set -e
-set -x
-
-output_path=static/third/zxcvbn
-commit_file_path=$output_path/commit
-commit=f15783727ac828f5a7e54ff5aed8dd8b38a62ffd # Change this to upgrade
-
-mkdir -p "$output_path"
-
-if [ -e "$commit_file_path" ]
-then
-    current_commit=`cat $commit_file_path`
-else
-    current_commit=00
-fi
-
-if [ "$current_commit" == "$commit" ]; then
-    echo "Already at latest version of zxcvbn.js"
-else
-    echo "$commit" > "$commit_file_path"
-    wget "https://raw.githubusercontent.com/dropbox/zxcvbn/$commit/zxcvbn.js" -O "$output_path/zxcvbn.js"
-fi
diff --git a/tools/update-prod-static b/tools/update-prod-static
index 1c95bf4823..4d912bb3e6 100755
--- a/tools/update-prod-static
+++ b/tools/update-prod-static
@@ -40,10 +40,6 @@ subprocess.check_call(['./tools/minify-js']
 subprocess.check_call(['./tools/setup/emoji_dump/build_emoji'],
                       stdout=fp, stderr=fp)
 
-# Download and include zxcvbn.js
-subprocess.check_call(['bash', '-ex', 'tools/setup/download-zxcvbn'],
-                      stdout=fp, stderr=fp)
-
 # Collect the files that we're going to serve.
 subprocess.check_call(['./manage.py', 'collectstatic', '--noinput', '-i', 'assets'],
                       stdout=fp, stderr=fp)
diff --git a/version.py b/version.py
index 3a919ed075..d905927d7b 100644
--- a/version.py
+++ b/version.py
@@ -1,2 +1,2 @@
 ZULIP_VERSION = "1.4.1+git"
-PROVISION_VERSION = '2.3'
+PROVISION_VERSION = '2.4'