Nova Visible Password Laravel Package

Technical Evaluation

What it is. A Laravel Nova custom field that extends Nova's Password field and ships a small compiled Vue component to toggle the input between type="password" and type="text". Integration surface is one Field class, a service provider for asset registration, and one front-end component. No migrations, routes, config, or middleware.

Architecture fit. Clean fit for admin panels already on Laravel Nova — it plugs into the standard field contract and inherits Nova's validation/rules behavior. It is inapplicable outside Nova (Filament, Backpack, custom Inertia admin), which bounds the addressable footprint to teams holding a Nova license. Because Nova itself is a commercial dependency, this package is a second-order dependency on a paid platform — vetting must include the Nova version, not just PHP/Laravel.

Integration feasibility. composer require plus one ::make() call per resource. Effort is measured in hours, not days. The gating question is version compatibility, not effort.

Technical risk.

Key questions to resolve before adoption. Which Nova major versions are supported (3/4/5)? Is the Vue component compiled against laravel-nova (requiring rebuilds per Nova upgrade) or standalone? Does it behave correctly on create forms, update forms, and inside Action modals? Does it respect hideFromIndex() / hideFromDetail()? Is the revealed value ever the persisted hash rather than the in-flight input?

Position. Low value as a long-lived dependency, real value as a pattern reference. Given the code volume, the honest comparison is "take a 3-star, three-year-stale dependency" versus "own ~100 lines." Ownership wins on every axis except the first hour.

Integration Approach

Stack fit. Laravel + Nova only. Confirm the pinned Nova major in composer.json first — this single check decides fork-vs-reimplement.

Path.

1. Spike (2–4 hours). Install on a throwaway branch against the production-pinned Nova version. Verify the toggle on create and edit, confirm no stored hash reaches the DOM, confirm no console errors.
2. Prefer the fork. Copy the Field class and component into app/Nova/Fields (or a private VCS repo) and own it. With zero dependents and no maintainer response path, the maintenance burden is yours either way — take the code.
3. Reimplement if Nova 5 blocks. One PHP field class plus one Vue component, roughly 1–2 dev-days including a Playwright smoke test and unit coverage of the field's resolve/fill behavior.
4. Abstract the usage. Register the field under a single internal alias so a future swap is a one-line diff per resource rather than a sweep.

Compatibility checklist. Nova major; PHP and Laravel versions; Vite vs. Mix and the laravel-nova npm package if the fork needs rebuilding; whether the published release ships pre-compiled assets (if so, add a rebuild step to CI).

Sequencing. Do not run this as a standalone initiative. Bundle it with the next Nova upgrade window so the compatibility question is answered once, in a change that is already touching admin assets. Ship behind the admin-only surface — no customer-facing blast radius — and record it in the dependency register with an owner and a review date tied to the next Nova major.

Operational Impact

Maintenance. Near-zero steady state if forked and untouched; ~0.5 day per Nova major to rebuild and re-verify the component. Consumed as-is, the burden is identical but without the ability to patch.

Support. No upstream channel and effectively no community corpus. Internal support is trivial: the observable failure is "toggle does nothing," and the fix is a rebuild or a version bump.

Scaling. Not a factor. One asset in the Nova bundle, no queries, no jobs, no external calls, no infra. Throughput and latency are unchanged.

Failure modes.

• Silent breakage on Nova upgrade — component fails to register, field degrades to a plain text input or loses the toggle. Detect with a CI/E2E smoke test on the user-edit screen.
• Hash disclosure — password hash rendered into DOM on detail/index. Enforce hideFromIndex() / hideFromDetail() at the field or resource level; add a DOM assertion to the smoke test.
• Stale asset vs. Nova's Vue runtime — console errors in admin, potentially blocking form submission. Covered by the same E2E test.
• Package removal or rename on Packagist — eliminated by forking or pinning to a private registry.

Ramp-up. Under an hour for a mid-level Laravel developer. No specialized knowledge beyond Nova's field and asset APIs, which the team needs regardless of this package.

TPM read. The value is the UX pattern, not the artifact: a reveal toggle measurably reduces provisioning typos and "I mistyped the password" admin tickets. Capture that value with an owned 1–2 day implementation, using this repo as the reference. Priority: low, cheap to build, cheap to own, disproportionately expensive to depend on.