- How do I install jord-jd/password_exposed in a Laravel application?
- Run composer require jord-jd/password_exposed and call the global helper or instantiate PasswordExposedChecker. The package ships no service provider, facade, config file, or validation rule, so Laravel integration is manual. No API key, migrations, or queue worker are required.
- Does jord-jd/password_exposed have native Laravel support?
- No. It is a single-purpose PHP library with global helper functions and a PasswordExposedChecker class, not a Laravel package. You must wire it into your registration, password change, reset, or audit flows yourself. If you want a validation rule or config file, you own that code.
- Which PHP and Laravel versions does password_exposed support?
- The README states PHP 7.1 through current releases, with PHP 8 able to use the PSR-6 v4 cache adapter and PHP 7 resolving the compatible v3 adapter. The TPM notes CI covers PHP 8.1 through 8.4 in recent releases. Laravel version compatibility follows the PHP version your Laravel release supports, but the package does not ship Laravel-specific constraints.
- How does password_exposed protect passwords with k-anonymity?
- It SHA1-hashes the password locally and sends only the first five characters of the hash to the Pwned Passwords v2 range endpoint. It compares returned suffixes using hash_equals for timing safety. No plaintext password or full SHA1 hash leaves your infrastructure.
- What do EXPOSED, NOT_EXPOSED, and UNKNOWN mean, and how should I handle UNKNOWN?
- EXPOSED means the password appears in a known breach, NOT_EXPOSED means it was not found, and UNKNOWN means the API check failed. UNKNOWN is a product policy decision: you can fail open for registration or fail closed for privileged account recovery. Document the policy per flow instead of only checking for EXPOSED.
- Can I check a SHA1 hash instead of a plain-text password?
- Yes. Use PasswordExposedChecker->passwordExposedByHash() with a SHA1 hash instead of the password_exposed() helper. The same three-state result and remote range-check behavior apply. This is useful when your application already stores or processes hashes.
- How do I configure HTTP timeouts, caching, or a custom HTTP client?
- The package supports injecting a PSR-18 HTTP client and PSR-6 cache pool, so you can reuse Laravel's Guzzle client and cache backend. It defaults to paragonie/certainty for TLS certificate validation and has a five-second default HTTP timeout that you may override. There is no publishable Laravel config file, so wire these dependencies in your own service container code.
- How can I test Laravel code that calls password_exposed without hitting the live API?
- Because the library depends on an external endpoint, mock or fake the PSR-18 HTTP client or inject a test double around PasswordExposedChecker. Cover all three states, including UNKNOWN timeouts and API errors. Also assert your chosen fail-open or fail-closed behavior in feature tests.
- What are the production risks of using password_exposed in a signup flow?
- The free api.pwnedpasswords.com endpoint becomes part of your signup path, so availability and latency affect registration. The package returns UNKNOWN on failure, and you must decide whether that blocks or allows the password. It emits no telemetry, so add your own logging or metrics for check volume, UNKNOWN rate, and p95 latency if auditors need proof.
- Is jord-jd/password_exposed maintained and what license does it use?
- It is a small, single-maintainer project with 223 stars and no published dependents, renamed from divineomega/* to jord-jd/* in v4 and at v5.0.0. Recent patches are mostly CI and housekeeping fixes, so treat it as maintained but not actively developed. It is LGPL-3.0 licensed, which requires legal review for closed-source products, especially if you fork, patch, or vendor the code.