- What is mcrumley/php-complexify and what does it do?
- mcrumley/php-complexify is a PHP port of Dan Palmer's jquery.complexify.js. It provides server-side password strength scoring and flags weak patterns such as common passwords, dictionary words, keyboard patterns, and repetition. In Laravel, it is best treated as an advisory strength estimator rather than a full password-policy framework.
- How do I install mcrumley/php-complexify in a Laravel app?
- Install it with Composer using composer require mcrumley/php-complexify, then confirm the package's PHP constraints and autoloading against your Laravel version. Because the last release was in 2018, run a short compatibility spike before adopting it. Wrap the vendor API in your own service or custom validation rule so controllers do not depend on Complexify directly.
- Does mcrumley/php-complexify work with Laravel 10/11 and PHP 8?
- Laravel 10 and 11 require modern PHP versions, while php-complexify's last release was in 2018, so compatibility is not guaranteed. Test the exact Composer version on your target PHP 8.x runtime and check for namespace or dependency issues. If it fails, fork the algorithm internally or choose a maintained alternative.
- How do I use Complexify password scoring in a Laravel validation rule?
- Create a custom Laravel validation rule or a small PasswordStrengthService that calls Complexify and returns a normalized score. Keep the package behind an interface so you can swap it for zxcvbn-php or an internal fork later. Pair the score with Laravel's required, min, confirmed, and rate-limiting controls rather than replacing them.
- Is php-complexify safe to use as the only password strength check in production?
- No. The package is an older client-side-derived strength meter and should not be the sole server-side password gate for production authentication. Use it for advisory feedback only unless a security review, compatibility proof, and maintenance plan are in place. Enforce baseline Laravel password rules and consider a breached-password check separately.
- What does Complexify score return and how do I set a threshold?
- The API shape should be confirmed in a spike, but Complexify-style libraries typically return a score plus a valid or strength indicator. Map any score to product policy explicitly instead of assuming a default threshold is secure. Document which threshold triggers warnings versus hard validation failures.
- Does php-complexify include dictionary or common password lists?
- The package documentation excerpt does not confirm how dictionary or common-password lists are bundled or how current they are. Before relying on flagging, inspect the package source and test known weak passwords, Unicode inputs, long passphrases, and empty values. Treat stale lists as advisory and add a maintained breached-password check if enforcement matters.
- Can I use php-complexify with Laravel Fortify, Jetstream, or Breeze?
- You can call it from a custom rule or service used by Fortify, Jetstream, Breeze, or custom registration and reset-password forms. Do not edit vendor code or couple auth flows directly to Complexify semantics. Keep Laravel's built-in password validation and rate limiting as the enforcement layer.
- What are alternatives to mcrumley/php-complexify for Laravel password strength?
- zxcvbn-php is a commonly considered maintained alternative for server-side password strength estimation. You can also fork Complexify into an internal namespace if you need its exact scoring behavior. Whichever you choose, keep the same internal service contract so Laravel forms and rules are unaffected.
- Is mcrumley/php-complexify maintained, and what if I need a fork?
- Upstream activity is low, with the last release in 2018, so assume your team must own upgrades and security review. Pin the Composer version, audit the license and tests, and keep a documented fallback to Laravel's baseline password rules. If upstream is inactive, vendor or fork the code internally and plan to replace it when needed.