Weave Code
Pwned Validator Laravel Package
assisted-mindfulness/pwned-validator
A Laravel validation rule that checks passwords against the Have I Been Pwned Pwned Passwords database using k-anonymity, so users can be blocked from choosing known-breached passwords without ever sending full credentials over the wire.
Super simple Laravel Validator for checking password via the Pwned Passwords service of Have I Been Pwned
Frequently asked questions about Pwned Validator
- How do I install pwned-validator in a Laravel application?
- Install it with composer require assisted-mindfulness/pwned-validator. Laravel package auto-discovery should register the service provider; if the package exposes a config file, publish it and review timeout and failure settings. Then add the package's validation rule to your password validation flow.
- How do I add pwned-validator to my Laravel password validation rules?
- Add the package's validation rule to the rules array used for registration or password reset. It can typically sit alongside Laravel's Password::rules() or a FormRequest rules method. Check the package README for the exact rule name and any configuration options.
- Does pwned-validator send the full password to Have I Been Pwned?
- No. The package is described as using the Pwned Passwords service with k-anonymity, which means only a partial hash prefix is sent rather than the plaintext password. That design lets you check for breached passwords without transmitting full credentials over the wire. You should still review the implementation and your privacy requirements before production use.
- Which Laravel and PHP versions are supported by pwned-validator?
- The supported versions are defined by the package's Composer constraints, so check its composer.json and Packagist metadata against your application's Laravel and PHP versions. The 1.0.0 release is the first stable release, but the release notes are minimal. Test installation in a non-production branch before upgrading framework versions.
- Is pwned-validator safe to use in production Laravel registration flows?
- It can be suitable for production if you account for the external Have I Been Pwned API dependency. Review timeout, retry, caching, rate limiting, and failure behavior, and add automated tests for success, failure, and timeout cases. Roll it out behind your existing password policy and monitor validation latency and API error rates.
- What happens when the Have I Been Pwned API is unavailable during validation?
- The outcome depends on how the package handles HTTP errors and how you configure it, so verify the failure semantics before relying on it. You must decide whether validation should fail open and allow the password or fail closed and reject it when the API cannot be reached. Document that choice and test it with mocked timeouts and error responses.
- Does pwned-validator cache Pwned Passwords API responses?
- The package context does not confirm built-in caching defaults, so check the configuration and source before assuming cache behavior. Because each validation can trigger an outbound request, high-volume applications should cache by hash prefix and use sensible timeouts. Load-test registration and password-reset flows with the rule enabled.
- How can I test pwned-validator without calling the real Pwned Passwords API?
- If the package uses Laravel's HTTP client, fake the outbound requests with Http::fake() in your test suite. Cover known-breached, safe, timeout, and API-error responses so the rule's behavior is predictable. If it does not use the Laravel client, inject or mock its HTTP dependency according to the package's design.
- How does pwned-validator compare to Laravel's built-in uncompromised password rule?
- Laravel includes an uncompromised validation rule that also checks passwords against breached-password data. This package is a separate option that may appeal if you want a dedicated rule or need compatibility with a specific Laravel version. Compare the supported framework versions, configuration, caching, and failure behavior before choosing.
- Is pwned-validator actively maintained and what license does it use?
- Check the GitHub repository and Packagist for the current license, open issues, recent commits, and release history. The 1.0.0 release is a stability signal, but the minimal release notes mean you should review the changelog and dependency constraints yourself. For production, track Composer updates and upstream Pwned Passwords API changes.
Weaver
How can I help you explore Laravel packages today?