- Can I install jbafford/password-strength-bundle in a Laravel app?
- No. It is a Symfony2 bundle wired through Symfony's DependencyInjection extension and Validator component, and it exposes no Laravel service provider or Illuminate\Contracts\Validation\Rule implementation. Composer resolution will also fail against modern Laravel and PHP constraints. Treat the source as reference code, not a dependency.
- Is jbafford/password-strength-bundle compatible with Laravel 10, Laravel 11, and PHP 8.2?
- No. The bundle targets Symfony 2.x on PHP 5.x, and Symfony 2.x reached end of life in November 2018. Its Composer constraints will not resolve in a Laravel 10/11 project on PHP 8.2+. There is no supported integration path into the Laravel validation kernel.
- What password-strength algorithm does jbafford/password-strength-bundle use?
- The overview does not confirm the exact scoring method; the useful logic lives in Constraints/PasswordStrengthValidator.php. Bundles of this vintage often count character classes (upper, lower, digit, symbol), which NIST SP 800-63B has moved away from. Run a short spike to determine whether it does naive composition counting, dictionary/pattern matching, or entropy estimation before deciding to port it.
- How do I port jbafford/password-strength-bundle's password scoring into a Laravel custom rule?
- Read Constraints/PasswordStrength.php and Constraints/PasswordStrengthValidator.php, extract the scoring function, and wrap it in an App\Rules\StrongPassword class implementing Illuminate\Contracts\Validation\Rule. Add fixture tests that pin passing and failing inputs and the error-message shape. Cite the bundle as prior art in the file header, and keep the rule free of Symfony dependencies.
- Does Laravel already have a built-in password strength rule?
- Yes. Since Laravel 8, the Password rule supports min(), mixedCase(), numbers(), symbols(), and uncompromised() for breached-password checks. For most applications, Password::min(12)->uncompromised() is stronger and better maintained than porting an old Symfony bundle. Centralize policy with Password::defaults() so registration, reset, and password-change flows share one rule.
- Is bjeavons/zxcvbn-php a better alternative to this bundle for Laravel password strength?
- If you genuinely need entropy scoring or pattern and dictionary rejection, zxcvbn-php is the better-maintained, framework-agnostic reference. You can wrap it in a Laravel custom rule without adopting Symfony bundle code. Use it only when Laravel's native Password rule and uncompromised() do not cover your requirement.
- What license does jbafford/password-strength-bundle use, and can I vendor its code?
- Verify the repository LICENSE before vendoring or copying any source; do not assume a permissive license. The technical evaluation flags license verification as a required spike task. If the license is acceptable, keep attribution and prior-art notes; if not, reimplement the behavior independently from characterized test cases.
- Is jbafford/password-strength-bundle actively maintained?
- No. The assessment describes upstream as dormant, with no issue triage, 28 stars, and zero dependents, so no downstream project has validated it against modern PHP or Symfony. If you port the logic, you own it fully. Prefer Laravel-native validation or a maintained library unless the spike proves unique value.
- Can I reuse the Symfony Constraint and ConstraintValidator from this bundle in Laravel's validator?
- No. Symfony constraints are wired through the Symfony Validator component and DependencyInjection extension. Laravel uses Illuminate\Validation\Factory and the Rule contract, with no compatible extension point for Symfony constraints. You must re-express the behavior as a Laravel rule or closure.
- How do I migrate a legacy Symfony service that uses jbafford/password-strength-bundle to Laravel?
- Freeze the Symfony service, extract its validation contract (passing and failing inputs plus error-message shape), and pin those behaviors as fixture tests for the Laravel replacement. Build App\Rules\StrongPassword, wire it into registration, reset, and password-change forms, and centralize it via Password::defaults(). Retire the Symfony code path once the Laravel endpoint carries production traffic.