PHPackages                             birke/rememberme - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. birke/rememberme

Abandoned → [mober/rememberme](/?search=mober%2Frememberme)ArchivedLibrary[Security](/categories/security)

birke/rememberme
================

Secure "Remember Me" functionality

4.0.1(5y ago)124453.6k↑37.6%30[5 issues](https://github.com/gbirke/rememberme/issues)[3 PRs](https://github.com/gbirke/rememberme/pulls)5MITPHPPHP ^7.4 || ^8.0

Since Mar 28Pushed 1y ago8 watchersCompare

[ Source](https://github.com/gbirke/rememberme)[ Packagist](https://packagist.org/packages/birke/rememberme)[ Docs](https://github.com/gbirke/rememberme)[ RSS](/packages/birke-rememberme/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (2)Dependencies (4)Versions (12)Used By (5)

Warning

This project has been abandoned in favor of

Secure "Remember Me"
====================

[](#secure-remember-me)

This library implements the best practices for implementing a secure "Remember Me" functionality on web sites. Login information and unique secure tokens are stored in a cookie. If the user visits the site, the login information from the cookie is compared to information stored on the server. If the tokens match, the user is logged in. A user can have login cookies on several computers/browsers.

This library is heavily inspired by Barry Jaspan's article "[Improved Persistent Login Cookie Best Practice](http://jaspan.com/improved%5Fpersistent%5Flogin%5Fcookie%5Fbest%5Fpractice)". The library protects against the following attack scenarios:

- The computer of a user is stolen or compromised, enabling the attacker to log in with the existing "Remember Me" cookie. The user knows this has happened. The user can remotely invalidate all login cookies.
- An attacker has obtained the "Remember Me" cookie and has logged in with it. The user does not know this. The next time he tries to log in with the cookie that was stolen, he gets a warning and all login cookies are invalidated.
- An attacker has obtained the database of login tokens from the server. The stored tokens are hashed so he can't use them without computational effort (rainbow tables or brute force).
- An attacker tries to log in with brute force, by systematically generating "Remember Me" cookies. With the default security settings and 100 tries per second (a very high number which would probably show up in the server logs), it would take 8 months for a 50% chance to guess a cookie value right.

Installation
------------

[](#installation)

```
composer require birke/rememberme

```

Usage example
-------------

[](#usage-example)

See the `example` directory for an example. You can run it on your local machine with the command

```
php -S 127.0.0.1:8085 -t example

```

To understand the basic application structure, have a look at `index.php` and the `user_is_looged_in.php` template.

The example uses the file system to store the tokens on the server side. In most cases it's better to swap the storage with the `PDOStorage` class.

Cookie configuration
--------------------

[](#cookie-configuration)

By default the cookie is valid for one week and for all paths in the domain it was set. It cannot be accessed/changed via JavaScript and will be transmitted on HTTP connections. If your application requires a different configuration (for example, if you are using HTTPS and want to enhance security by only allowing transmission of the cookie over the secure connection), you can create your own PHPCookie instance:

```
$expire = strtotime("1 week", 0);
$cookie = new PHPCookie("REMEMBERME", $expire, "/", "", true, true);
$auth = new Authenticator($storage, null, $cookie);
```

Token security
--------------

[](#token-security)

This library uses the [`random_bytes`](http://php.net/manual/en/function.random-bytes.php) function by default to generate a 16-byte token (a 32 char hexadecimal string). That should be sufficiently secure for most applications.

If you need more security, instantiate the `Authenticator` class with a custom token generator. The following example generates Base64-encoded tokens with 128 characters:

```
$tokenGenerator = new DefaultToken(94, DefaultToken::FORMAT_BASE64);
$auth = new Authenticator($storage, $tokenGenerator);
```

If you like even more control over the generation of your random tokens, have a look at the [RandomLib](https://github.com/ircmaxell/RandomLib). Rememberme has a `RandomLibToken` class that can use it.

Cleaning up expired tokens
--------------------------

[](#cleaning-up-expired-tokens)

The best way to clean expired tokens from your storage (file system or database) is to write a small script that initializes your token storage class and calls its `cleanExpiredTokens` method. Run this script regularly with a cron job or other worker method.

If you can't run the cleanup script regularly and have a low-traffic site, you can clean the storage on every page call by initializing the Authenticator class like this:

```
 $auth = new Authenticator($storage);
 $auth->setCleanExpiredTokensOnLogin(true);
```

Updating from Version 1.x
-------------------------

[](#updating-from-version-1x)

The first you'll have to do is update the result checking of the `Authenticator::login` method. It no longer returns a boolean/the credentials, but instead returns a result object that must be queried for success, failure and credentials. See the example for how it is done.

If you did subclass `Authenticator` with a custom `createToken` method, you need to implement your token generation in a custom class that implements `TokenInterface`and pass it as a constructor argument.

The less secure pseudo-random tokens of the old version will be replaced by more secure tokens whenever a login occurs. For better security (and less convenience of your users) you could completely clear your token storage once after updating.

###  Health Score

50

—

FairBetter than 96% of packages

Maintenance31

Infrequent updates — may be unmaintained

Popularity52

Moderate usage in the ecosystem

Community29

Small or concentrated contributor base

Maturity75

Established project with proven stability

 Bus Factor1

Top contributor holds 74.3% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~323 days

Recently: every ~383 days

Total

9

Last Release

1848d ago

Major Versions

1.0.5 → 2.0.02017-02-20

2.0.1 → 3.0.02020-05-05

3.0.0 → 4.0.12021-04-26

PHP version history (2 changes)3.0.0PHP ^7.2

4.0.1PHP ^7.4 || ^8.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/33b488eec014d318101af995ecad38a80bc1f87fd4323c71fb081ac63928837b?d=identicon)[gbirke](/maintainers/gbirke)

---

Top Contributors

[![gbirke](https://avatars.githubusercontent.com/u/223326?v=4)](https://github.com/gbirke "gbirke (81 commits)")[![m-ober](https://avatars.githubusercontent.com/u/11992838?v=4)](https://github.com/m-ober "m-ober (9 commits)")[![dependabot-preview[bot]](https://avatars.githubusercontent.com/in/2141?v=4)](https://github.com/dependabot-preview[bot] "dependabot-preview[bot] (7 commits)")[![paragonie-scott](https://avatars.githubusercontent.com/u/11591518?v=4)](https://github.com/paragonie-scott "paragonie-scott (5 commits)")[![tthomas48](https://avatars.githubusercontent.com/u/168526?v=4)](https://github.com/tthomas48 "tthomas48 (2 commits)")[![josegonzalez](https://avatars.githubusercontent.com/u/65675?v=4)](https://github.com/josegonzalez "josegonzalez (2 commits)")[![HobieCat](https://avatars.githubusercontent.com/u/4680160?v=4)](https://github.com/HobieCat "HobieCat (1 commits)")[![frostbitten](https://avatars.githubusercontent.com/u/593791?v=4)](https://github.com/frostbitten "frostbitten (1 commits)")[![dampfklon](https://avatars.githubusercontent.com/u/1733625?v=4)](https://github.com/dampfklon "dampfklon (1 commits)")

---

Tags

securitycookieremember

###  Code Quality

TestsPHPUnit

Code StylePHP\_CodeSniffer

### Embed Badge

![Health badge](/badges/birke-rememberme/health.svg)

```
[![Health](https://phpackages.com/badges/birke-rememberme/health.svg)](https://phpackages.com/packages/birke-rememberme)
```

###  Alternatives

[phpseclib/phpseclib

PHP Secure Communications Library - Pure-PHP implementations of RSA, AES, SSH2, SFTP, X.509 etc.

5.6k434.8M1.3k](/packages/phpseclib-phpseclib)[defuse/php-encryption

Secure PHP Encryption Library

3.9k162.4M214](/packages/defuse-php-encryption)[mews/purifier

Laravel 5/6/7/8/9/10 HtmlPurifier Package

2.0k16.7M113](/packages/mews-purifier)[robrichards/xmlseclibs

A PHP library for XML Security

41478.1M118](/packages/robrichards-xmlseclibs)[voku/anti-xss

anti xss-library

72317.1M77](/packages/voku-anti-xss)[spatie/laravel-csp

Add CSP headers to the responses of a Laravel app

8569.6M19](/packages/spatie-laravel-csp)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)