- How do I install martbock/laravel-diceware in a Laravel app?
- Install it with Composer using composer require martbock/laravel-diceware. The package uses Laravel package auto-discovery, so the service provider and facade are registered automatically and no manual provider entry is needed in a standard Laravel skeleton. After installing, run php artisan config:clear and rebuild your config cache as part of your normal deploy step. This is a sub-hour integration because there are no migrations, no published assets required, and no external services to configure.
- Does martbock/laravel-diceware support Laravel 10?
- Yes. Version 2.1.0 widened the framework constraint to include Laravel 10, contributed via an outside pull request. The public API, facade, and config contract appear unchanged from v2.0.0, so this is an additive compatibility release rather than a redesign. Confirm the exact constraint in the package composer.json before rollout, since you want to verify it widened rather than replaced the previous Laravel version support.
- How do I generate a diceware passphrase with this package?
- Generation goes through the package facade, which wraps a config-driven diceware wordlist. You call the facade to produce a word-based passphrase using your configured word count, separator, and language. Because the package is stateless and does not touch the database, you can call it anywhere in your application, including jobs, console commands, and service classes. Validate it first with a short smoke test in a development branch before wiring it into credential issuance.
- Can I configure the number of words in a generated passphrase?
- Yes, the word count is configurable, along with the separator used between words, and sane defaults are provided. Word count is the primary lever for entropy per passphrase, so pick it based on the sensitivity of the credential you are issuing. Initial passwords, invite tokens, and recovery codes can justify different lengths. Document the chosen value in your config so entropy per passphrase is calculable and reviewable.
- Which wordlists and languages ship with laravel-diceware?
- The package ships bundled diceware wordlists and supports multiple languages, selectable through configuration. Before using it in production, confirm which lists are included, what license each wordlist carries, and how many words each list contains, since that determines the entropy contributed per word. The bundled list is read from the vendor directory, so it works fine on containerized deploys with read-only filesystems as long as you are not relying on a published config artifact.
- Is the passphrase generation cryptographically secure?
- That is the single most important thing to verify, since the package's entire value is entropy. Confirm that word selection uses a CSPRNG exclusively, such as random_int or Random\Randomizer, with no mt_rand-style fallback path anywhere in the generation code. Also check that wordlist selection has no off-by-one that would silently bias or shrink the selection space. A manual spot-check, generating a batch of passphrases and confirming word counts and the absence of pattern artifacts, is a cheap sanity test to pair with a code read.
- Does laravel-diceware require a database, migrations, or extra infrastructure?
- No. The package is a thin, stateless service provider plus facade over a config-driven wordlist, with no persistence, migrations, queues, events, or external service calls. It imposes no database, cache, or filesystem requirements beyond reading its bundled wordlist from the vendor directory. That makes it a clean fit for any Laravel application that needs human-readable high-entropy secrets without standing up additional infrastructure.
- How do I test diceware passphrase generation in my application?
- Treat it as a utility library in your test suite: assert that generated passphrases have the expected word count and separator, and that consecutive calls produce different results. Avoid asserting on specific words, since output is random by design and such tests will be flaky. In a development branch, run your full test suite plus a manual entropy spot-check that generates a batch of passphrases and looks for repeats or pattern artifacts.
- Is Laravel 9 still supported alongside Laravel 10 in v2.1.0?
- The intent of v2.1.0 is to add Laravel 10 support additively while retaining Laravel 9, which matters if some of your applications have not upgraded yet. Verify this directly in the package composer.json before rolling out, because if the release replaced rather than widened the constraint, apps mid-upgrade could be stranded. If the constraint was widened, adoption for an existing v2.0.0 install is just a minor Composer bump plus a config cache clear.
- What are the risks of depending on a single-maintainer package for password generation?
- The dominant risk is not technical complexity but provenance and correctness of a security-sensitive primitive: a defect in the random source, a mis-specified wordlist, or an off-by-one in word selection would silently weaken every generated credential. Secondary concerns are a low bus factor for a single-maintainer project, bundled wordlist licensing terms, and an unclear supported-PHP floor, which you should check against your PHP 8.1 or 8.2 runtime. Laravel 10 support arriving from an outside contributor is a positive community signal but also confirms the maintainer bandwidth constraint, so pin the version and review upgrades rather than tracking the latest release blindly.