- Can I use hackzilla/password-generator-bundle in a Laravel application?
- No. The bundle exists only to wire the Hackzilla Password Generator library into Symfony's dependency injection container and configuration system, and Laravel does not read Symfony bundle manifests. Installing it in a Laravel app would pull in symfony/framework-bundle and related components for no functional benefit. The reusable piece is the underlying hackzilla/password-generator library, which is plain PHP and framework-agnostic.
- What is the difference between hackzilla/password-generator-bundle and hackzilla/password-generator?
- The library is a framework-independent PHP package that generates configurable passwords using selectable character sets. The bundle is a thin Symfony integration layer made of a compiler pass, service definitions, and configuration that expose the library as a container service. In Laravel only the library makes sense; the bundle adds nothing you can consume.
- How do I install and configure this bundle in a Symfony project?
- Install it with composer require hackzilla/password-generator-bundle, register the bundle in config/bundles.php, then configure the available character sets and length options under the bundle's configuration key. You can then inject the generator service into your own services via autowiring. This Symfony workflow is exactly what does not translate to Laravel.
- Does this package support Laravel 10 or Laravel 11?
- There is no supported integration path for any Laravel version. The bundle targets Symfony's kernel and container, and Laravel 10 and 11 ship Str::password() in Illuminate\Support\Str, which covers most password-generation needs with zero extra dependencies. Adding the bundle would create Composer constraints against Symfony components that your Laravel app does not use.
- Is the password generator cryptographically secure, and does it use random_bytes()?
- The underlying library is built on PHP's CSPRNG functions, random_bytes() and random_int(), rather than mt_rand(). That said, password generation is security-sensitive, so verify the exact pinned version's source and confirm there is no fallback to non-cryptographic randomness before relying on it. This verification burden is one reason many teams prefer the framework's own generator.
- How do I generate a secure password in Laravel without adding this package?
- Laravel 10 and later provide Str::password($length, $letters, $numbers, $symbols, $spaces), which uses random_bytes() internally and lets you control length and character classes. For custom policies, a short helper built on random_int() gives you full control over required character classes and ambiguous-character exclusion. Both options avoid adding a single-maintainer dependency for a capability the framework already provides.
- What is the best way to integrate the Hackzilla library into Laravel if I really want it?
- Depend on hackzilla/password-generator only, never the bundle. Bind a small PasswordGeneratorInterface in a service provider, expose length and character-set settings through config/passwords.php, and resolve the generator via constructor injection. Wrapping the library behind your own contract keeps the framework clean and lets you swap in Str::password() later with a one-line binding change.
- Will installing this bundle cause Composer conflicts in my Laravel project?
- Possibly. The bundle constrains symfony/framework-bundle and related Symfony packages plus specific PHP versions, and those constraints still resolve at install time even though Laravel never uses them. If any Symfony component is already present transitively, you can hit version resolution conflicts. It is a real risk with no upside in a Laravel codebase.
- Is hackzilla/password-generator-bundle actively maintained and widely used?
- Adoption is low, with roughly 18 GitHub stars, a single maintainer, and a thin issue history, which is a weak signal for a security-adjacent component. Before adopting anything here, check the last commit date and open-issue counts on both the bundle and the underlying library. Low community validation means you should expect to own the maintenance risk yourself.
- How should I test password generation in a Laravel application?
- Test the contract rather than exact output: assert the generated password meets the requested length, uses only allowed character classes, and includes any mandatory symbol or digit classes. You cannot seed a CSPRNG, so avoid tests that expect deterministic strings. If you wrap the generator behind an interface, you can bind a fake in tests and keep the assertions focused on your policy rules.