- How do I install andrey-helldar/strong-password in a Laravel app?
- Install it with Composer using composer require andrey-helldar/strong-password, then add the package's validation key to a form request, controller, or Validator::make call. Integration is essentially a string in a validation array, so a Laravel developer can wire it up in minutes. However, the repository is archived, so treat installation as reference-only and confirm the rule contract before using it in a current Laravel application.
- Does andrey-helldar/strong-password support Laravel 10 and Laravel 11?
- No. The last release was 2020-12-30, which predates Laravel 9, 10, and 11, and the repository is archived with no compatibility work. On Laravel 10 and later, custom rules should implement Illuminate\Contracts\Validation\ValidationRule, while the older Rule contract is deprecated. Whether this package satisfies the current contract is unverified and must be confirmed by reading the source.
- Is andrey-helldar/strong-password still maintained?
- No. The GitHub repository is archived, the last release is 2020-12-30, and it has roughly 17 stars with no maintainer activity. That means no security patches, no PHP 8.x or Laravel 11 compatibility work, and no issue triage. Adopting it effectively converts an abandoned external dependency into an internal one you now own.
- What is the Laravel native alternative to strong-password?
- Laravel ships Illuminate\Validation\Rules\Password, available since Laravel 8, with methods such as min(), mixedCase(), numbers(), symbols(), and uncompromised(). You can also use Password::defaults() to define an application-wide policy. For current Laravel versions, the native rule is the maintained and idiomatic alternative.
- Does strong-password check for breached or compromised passwords?
- Almost certainly not. The package's value proposition is length plus character-composition rules, and the evaluation notes it almost certainly does not do breach-list checking such as uncompromised(). If your policy requires HIBP or breach-corpus checking, this package cannot satisfy it; use Laravel's uncompromised() instead.
- What password rules does strong-password enforce?
- It enforces strong-password checks based on length and character composition, exposed as a Laravel validation rule. The evaluation describes the capability as roughly one class and one regex. It does not provide persistence, configuration surfaces, or I/O, and it does not appear to cover breach checking.
- Can I use strong-password as a custom validation rule on Laravel 10 or 11?
- Not reliably. The package predates Laravel 10 and 11, and the older Rule contract is deprecated; current custom rules should implement ValidationRule. The evaluation says whether the package's rule satisfies that contract is unverified and must be confirmed by reading the source, not the README. A contract or signature mismatch can surface as a fatal error at validation time on registration, login, or password-reset paths.
- Is it safe to use an archived package for password validation in production?
- Not recommended. Abandonment risk is high, runtime failures are late-bound on security-critical paths, and encoding policy in an unmaintained third-party regex makes the policy unauditable and hard to change. The evaluation's disposition is to treat the repository as reference source to read and reimplement, not as a dependency to adopt. Supply-chain risk is low, but that does not offset the maintenance and policy risks.
- How do I migrate from strong-password to Laravel's built-in Password rule?
- Do not require the package; create a first-party rule with the same validation key your app already uses and delegate internally to Password::min(N)->mixedCase()->numbers()->symbols()->uncompromised(). Existing validation strings such as 'password' => 'strong_password' keep working if you preserve the key. Read the package source for design reference, then test the replacement on registration, login, and password-reset flows.
- Are strong-password validation error messages translatable?
- The evaluation does not verify localization. Failure messages are part of the rule's implementation, so you must read the source to confirm whether they are translatable and meet your UX and legal review standards for security copy. Laravel's native Password rule provides framework-standard validation messages that are localizable through Laravel's translation files.