PHPackages bbs-lab/laravel-password-rotation - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. bbs-lab/laravel-password-rotation ActiveLibrary[Authentication & Authorization](/categories/authentication) bbs-lab/laravel-password-rotation ================================= Password rotation for any Laravel app (no admin panel required): force any authenticatable to rotate its password every N days, with reuse prevention, a first-login gate, expiry warnings and a redirect middleware. v1.1.0(today)051↑2664.7%MITPHPPHP ^8.2CI passing Since Jul 23Pushed todayCompare [ Source](https://github.com/BBS-Lab/laravel-password-rotation)[ Packagist](https://packagist.org/packages/bbs-lab/laravel-password-rotation)[ Docs](https://github.com/BBS-Lab/laravel-password-rotation)[ RSS](/packages/bbs-lab-laravel-password-rotation/feed)WikiDiscussions main Synced today READMEChangelog (2)Dependencies (14)Versions (3)Used By (0) Laravel Password Rotation ========================= [](#laravel-password-rotation) [![Latest Version on Packagist](https://camo.githubusercontent.com/34048c9e8875f18c2d31683b636c1b46676ab2758a2c0b2a0413cd22c96b3100/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6262732d6c61622f6c61726176656c2d70617373776f72642d726f746174696f6e2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/bbs-lab/laravel-password-rotation)[![Tests](https://camo.githubusercontent.com/24f8fca452f58ec416f956db750487214fd0aeef5261dea9d241da775a3fa216/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f4242532d4c61622f6c61726176656c2d70617373776f72642d726f746174696f6e2f72756e2d74657374732e796d6c3f6272616e63683d6d61696e266c6162656c3d7465737473267374796c653d666c61742d737175617265)](https://github.com/BBS-Lab/laravel-password-rotation/actions)[![Total Downloads](https://camo.githubusercontent.com/050b4ae41f57565547846bedcf628cd7af082fd697e3da14b8fd3b40672d0fa1/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6262732d6c61622f6c61726176656c2d70617373776f72642d726f746174696f6e2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/bbs-lab/laravel-password-rotation) Password rotation for any Laravel application — **no admin panel required**. Force any authenticatable model to **rotate its password every N days**, with reuse prevention, a first-login gate, an expiry-warning helper and a redirect middleware. No Nova, no Filament. This is the shared core behind the two admin-panel twins: - [`bbs-lab/nova-password-rotation`](https://github.com/BBS-Lab/nova-password-rotation) — Laravel Nova - [`bbs-lab/filament-password-rotation`](https://github.com/BBS-Lab/filament-password-rotation) — Filament The rotatable subject is **not** tied to the `User` model: everything keys off the `MustRotatePassword` interface on whatever authenticatable you gate, and the password history is **polymorphic**, so any model works. Requirements ------------ [](#requirements) - PHP `^8.2` - Laravel `^11.0 || ^12.0 || ^13.0` Installation ------------ [](#installation) ``` composer require bbs-lab/laravel-password-rotation ``` The service provider auto-registers via Laravel package discovery. The `password_histories` table migrates automatically. Publish the config and the (review-before-run) user-column migration, then migrate: ``` # Config php artisan vendor:publish --tag=laravel-password-rotation-config # Adds the password_changed_at column to your authenticatable's table. # Rename/edit it first — your rotatable model rarely lives on "users". php artisan vendor:publish --tag=laravel-password-rotation-user-migration # Optional — only to customise the shipped password_histories migration # php artisan vendor:publish --tag=laravel-password-rotation-migrations # Translations (en, fr) — only to customise the messages php artisan vendor:publish --tag=laravel-password-rotation-translations php artisan migrate ``` Usage ----- [](#usage) ### Make a model rotatable [](#make-a-model-rotatable) Implement `MustRotatePassword` and use the `RotatesPassword` trait on any authenticatable model. Nothing is tied to `User` — the trait keys off the interface and the history table is polymorphic. ``` use BBSLab\LaravelPasswordRotation\Concerns\RotatesPassword; use BBSLab\LaravelPasswordRotation\Contracts\MustRotatePassword; use Illuminate\Foundation\Auth\User as Authenticatable; class User extends Authenticatable implements MustRotatePassword { use RotatesPassword; } ``` The trait stamps `password_changed_at` whenever the password changes, records each hash for reuse prevention, and dispatches `PasswordRotated`. It exposes: - `passwordHasExpired(): bool` — past the rotation window (or never set, when `force_on_first_login` is on) - `passwordIsExpiring(): bool` — inside the warning window (`warn_days`) - `passwordExpiresAt(): ?CarbonInterface` ### Force expired users to a change screen [](#force-expired-users-to-a-change-screen) Add `EnsurePasswordIsNotExpired` to the middleware group that guards your app and point `redirect_route` at your own password-change screen: ``` // config/laravel-password-rotation.php 'redirect_route' => 'password.rotate', // keep users able to sign out while their password is expired 'except_routes' => ['logout'], ``` ``` Route::middleware(['web', 'auth', EnsurePasswordIsNotExpired::class])->group(function () { // ...your app }); ``` An expired user is redirected to `redirect_route` on every request except that route and anything in `except_routes`. **Exempt your logout route** (and, if the change form POSTs to a different route, that route too) or the user is trapped with no way out. The middleware reads the default guard's user; on a custom guard, wire it accordingly. ### Prevent password reuse [](#prevent-password-reuse) Add the `PasswordNotReused` rule to your change-password validation: ``` use BBSLab\LaravelPasswordRotation\Rules\PasswordNotReused; $request->validate([ 'password' => ['required', 'confirmed', Password::defaults(), new PasswordNotReused($request->user())], ]); ``` It rejects the current password and the last `history_count` hashes. ### Report on rotation status [](#report-on-rotation-status) ``` php artisan password-rotation:report # expired / expiring-soon accounts php artisan password-rotation:report --all # every account ``` The command scans the classes listed under `models` in the config. License ------- [](#license) The MIT License (MIT). Please see [License File](LICENSE.md) for more information. ### Health Score 44 — FairBetter than 90% of packages Maintenance100 Actively maintained with recent releases Popularity12 Limited adoption so far Community7 Small or concentrated contributor base Maturity47 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 0d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/5689944?v=4)[Mikaël Popowicz](/maintainers/mikaelpopowicz)[@mikaelpopowicz](https://github.com/mikaelpopowicz) ![](https://www.gravatar.com/avatar/c1edc17683ed39a2cc6dbe453c2c5aaa63468fc5b54f13941f260ebe260da211?d=identicon)[Kezho](/maintainers/Kezho) --- Top Contributors [![mikaelpopowicz](https://avatars.githubusercontent.com/u/5689944?v=4)](https://github.com/mikaelpopowicz "mikaelpopowicz (4 commits)") --- Tags authenticationlaravellaravel-packagemiddlewarepassword-expirationpassword-historypassword-policypassword-rotationpassword-securityphpsecuritymiddlewarelaravelsecuritypasswordbbspassword-rotationpassword-expiration ### Code Quality TestsPest Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/bbs-lab-laravel-password-rotation/health.svg) ``` [![Health](https://phpackages.com/badges/bbs-lab-laravel-password-rotation/health.svg)](https://phpackages.com/packages/bbs-lab-laravel-password-rotation) ``` ### Alternatives [spatie/laravel-permission Permission handling for Laravel 12 and up 12.9k102.4M1.5k](/packages/spatie-laravel-permission)[defstudio/telegraph A laravel facade to interact with Telegram Bots 813336.8k3](/packages/defstudio-telegraph)[psalm/plugin-laravel Psalm plugin for Laravel 3345.3M347](/packages/psalm-plugin-laravel)[harris21/laravel-fuse Circuit breaker for Laravel queue jobs. Protect your workers from cascading failures. 44855.7k](/packages/harris21-laravel-fuse)[spatie/laravel-passkeys Use passkeys in your Laravel app 472890.7k40](/packages/spatie-laravel-passkeys)[rawilk/profile-filament-plugin Profile & MFA starter kit for filament. 3914.8k](/packages/rawilk-profile-filament-plugin) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)