Laravel Diceware Laravel Package

Product Decisions This Supports

• Build vs. buy for passphrase generation. This package wraps a Diceware wordlist and a cryptographically secure RNG behind a Laravel facade. The functional surface is small enough to build in-house in under a day, so the decision hinges on whether you want to own wordlist curation, CSPRNG correctness, and entropy guarantees. For most teams this is a "buy" (i.e., take the dependency) only if it saves review time on security-sensitive generation code.
• Feature: human-friendly credential generation. Directly supports anything where a user must read, transcribe, or say a secret aloud: temporary passwords on account invite, admin-initiated resets, support-assisted recovery, Wi-Fi/onboarding passphrases, invite-link secrets, physical or verbal handoff flows. This is the differentiator versus random-string generators — memorability and transcribability, not raw entropy density.
• Feature: security posture and compliance signalling. Choosing a Diceware-based scheme gives you a defensible, standards-adjacent story ("EFF-style wordlist, CSPRNG-backed, tunable word count") that is easier to document in a security questionnaire than a hand-rolled Str::random() call.
• Roadmap input — Laravel 10 support (v2.1.0). The v2.1.0 release is a compatibility-only change: it adds Laravel 10 support with no new features, no breaking changes, and no deprecations. The product-relevant signal is sustained maintenance: the package now covers a currently supported framework major, so it is not a blocker for a Laravel 10 upgrade. It does not change the underlying capability set — treat it as risk reduction, not scope expansion.
• Upgrade sequencing. If your roadmap includes a Laravel 9→10 move, this release removes the package from your pre-upgrade blocker list. That is a scheduling fact worth recording, not a reason to prioritise new work.

When to Consider This Package

Adopt when:

• You need memorable, transcribable secrets for humans — onboarding credentials, temporary passwords, verbal handoff, printed recovery codes — rather than machine-to-machine tokens.
• You are on Laravel 10 (or 9) and want the framework-native service-container/facade integration rather than a plain PHP library.
• Your team would rather delegate wordlist curation and entropy defaults to a maintained dependency than defend in-house crypto-adjacent code in review and audits.
• You want a configurable word count so product/security can dial entropy per surface (e.g., shorter for low-risk onboarding, longer for admin secrets).

Look elsewhere (or build in-house) when:

• You need machine-generated API keys, session tokens, or high-entropy secrets — a wordlist-based passphrase is the wrong tool; use a byte-oriented random token generator.
• You need password policy enforcement, strength scoring, breached-password checks, or Argon2/bcrypt hashing — this package generates, it does not validate or store.
• You require a large maintainer base or vendor SLA. This is a single-maintainer, narrow-scope package. If your procurement bar requires multi-maintainer projects, plan to vendor the code or reimplement.
• You need localisation of wordlists — confirm the wordlist is suitable for your user population before committing; English-language wordlists are a poor fit for non-English-first audiences.
• You are on a framework version not covered by the release line — verify current support breadth rather than assuming forward compatibility.

How to Pitch It (Stakeholders)

To executives: This is a small, low-risk dependency that lets us issue passwords people can actually read and repeat — think onboarding invites and support-assisted resets. The new v2.1.0 release adds Laravel 10 support, so it stays compatible with our framework upgrade path. No new features, no breaking changes, no migration work. Cost of adoption is minimal; the main caveat is that it is a single-maintainer package, so we should treat it as a convenience wrapper over well-understood crypto primitives, not a critical-path security control.

To engineering: v2.1.0 is a compatibility release — Laravel 10 support only, no API changes, no deprecations, no action required beyond the normal upgrade. The package provides a facade over EFF-style Diceware passphrase generation with a configurable word count and CSPRNG backing. It solves exactly one problem — generating human-transcribable secrets — and does not handle validation, hashing, storage, or policy. Entropy is a function of word count and wordlist size; set the count per surface and document the reasoning. Because the scope is narrow and the maintainer count is one, recommend wrapping it behind an internal PassphraseGenerator interface so we can swap or vendor it without touching call sites.