PHPackages                             langleyfoxall/laravel-nist-password-rules - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. langleyfoxall/laravel-nist-password-rules

ActiveLibrary[Security](/categories/security)

langleyfoxall/laravel-nist-password-rules
=========================================

🔒 Provides Laravel validation rules that follow the password related recommendations found in NIST Special Publication 800-63B.

v8.1.0(10mo ago)211564.6k—0%56[8 issues](https://github.com/langleyfoxall/laravel-nist-password-rules/issues)[7 PRs](https://github.com/langleyfoxall/laravel-nist-password-rules/pulls)6LGPL-3.0-onlyPHPPHP >=7.2

Since Oct 31Pushed 10mo ago6 watchersCompare

[ Source](https://github.com/langleyfoxall/laravel-nist-password-rules)[ Packagist](https://packagist.org/packages/langleyfoxall/laravel-nist-password-rules)[ RSS](/packages/langleyfoxall-laravel-nist-password-rules/feed)WikiDiscussions master Synced 1mo ago

READMEChangelog (10)Dependencies (5)Versions (29)Used By (6)

🔒 Laravel NIST Password Rules
=============================

[](#-laravel-nist-password-rules)

[![Build Status](https://camo.githubusercontent.com/bf69060672c1c5a826c5b40832a9e8886cde9b6ed020cd3705f696b2bdcb65f1/68747470733a2f2f7472617669732d63692e6f72672f6c616e676c6579666f78616c6c2f6c61726176656c2d6e6973742d70617373776f72642d72756c65732e7376673f6272616e63683d6d6173746572)](https://travis-ci.org/langleyfoxall/laravel-nist-password-rules)[![Coverage Status](https://camo.githubusercontent.com/831049714522c94566da3018fca8e19ec6350c0bf9efc8a1c9a0038352462fea/68747470733a2f2f636f766572616c6c732e696f2f7265706f732f6769746875622f6c616e676c6579666f78616c6c2f6c61726176656c2d6e6973742d70617373776f72642d72756c65732f62616467652e7376673f6272616e63683d6d6173746572)](https://coveralls.io/github/langleyfoxall/laravel-nist-password-rules?branch=master)[![StyleCI](https://camo.githubusercontent.com/01845bc70fca40082f4f19c6eaa0a6c3d01e3f2ee40e7e08230218961f89a15e/68747470733a2f2f6769746875622e7374796c6563692e696f2f7265706f732f3135343835333038322f736869656c643f6272616e63683d6d6173746572)](https://github.styleci.io/repos/154853082)[![Packagist](https://camo.githubusercontent.com/6b3b53c92fb17bc35e6eab8e2d1f016c83bc798b6efeef1873334dd00ce2eaff/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6c616e676c6579666f78616c6c2f6c61726176656c2d6e6973742d70617373776f72642d72756c65732e737667)](https://packagist.org/packages/langleyfoxall/laravel-nist-password-rules/stats)

This package provides Laravel validation rules that follow the password related recommendations found in [NIST Special Publication 800-63B section 5](https://pages.nist.gov/800-63-3/sp800-63b.html#sec5).

Laravel NIST Password Rules implements the following recommendations.

RecommendationImplementation\[...\] at least 8 characters in lengthA standard validation rule in all rule sets to validate against this minimum length of 8 characters.Passwords obtained from previous breach corpusesThe `BreachedPasswords` rule securely checks the password against previous 3rd party data breaches, using the [Have I Been Pwned - Pwned Passwords](https://haveibeenpwned.com/Passwords) API.Dictionary wordsThe `DictionaryWords` rule checks the password against a list of over 102k dictionary words.Context-specific words, such as the name of the service, the usernameThe `ContextSpecificWords` rule checks the password does not contain the provided username, and any words defined the configured app name or app URL.Context-specific words, \[...\] and derivatives thereofThe `DerivativesOfContextSpecificWords` rule checks the password is not too similar to the provided username, and any words defined the configured app name or app URL.Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’)The `RepetitiveCharacters` and `SequentialCharacters` rules checks if the password consists of only repetitive or sequential characters.It also provides methods to return validation rules arrays for various scenarios, such as register, login, and password changes. These arrays can be passed directly into the Laravel validator.

Installation
------------

[](#installation)

Laravel NIST Password Rules can be easily installed using Composer. Just run the following command from the root of your project.

```
composer require langleyfoxall/laravel-nist-password-rules
```

If you have never used the Composer dependency manager before, head to the Composer website for more information on how to get started.

Optionally, you may publish the package's translation files with the following Artisan command.

```
php artisan vendor:publish --provider="LangleyFoxall\LaravelNISTPasswordRules\ServiceProvider"
```

Usage
-----

[](#usage)

To use the Laravel NIST Password Rules in your project, first `use` the `PasswordRules` class, then call the appropriate static methods to return an array of appropriate validation rules. There are methods available for the following scenerios.

- Register
- Change password, with old password
- Change password, without old password
- Optionally change password, with old password
- Optionally change password, without old password
- Login

See the code below for example usage syntax.

```
use LangleyFoxall\LaravelNISTPasswordRules\PasswordRules;

// Register
$this->validate($request, [
    'email' => 'required',
    'password' => PasswordRules::register($request->email),
]);

// Register, without requiring password confirmation
$this->validate($request, [
    'email' => 'required',
    'password' => PasswordRules::register($request->email, false),
]);

// Change password, with old password
$this->validate($request, [
    'old_password' => 'required',
    'password' => PasswordRules::changePassword($request->email, 'old_password'),
]);

// Change password, without old password
$this->validate($request, [
    'password' => PasswordRules::changePassword($request->email),
]);

// Optionally change password, with old password
$this->validate($request, [
    'old_password' => 'required',
    'password' => PasswordRules::optionallyChangePassword($request->email, 'old_password'),
]);

// Optionally change password, without old password
$this->validate($request, [
    'password' => PasswordRules::optionallyChangePassword($request->email),
]);

// Login
$this->validate($request, [
    'email' => 'required',
    'password' => PasswordRules::login(),
]);
```

The `optionallyChangePassword` method supplies validation rules that are appropriate for forms in which the password can be optionally changed if filled in.

###  Health Score

55

—

FairBetter than 98% of packages

Maintenance54

Moderate activity, may be stable

Popularity55

Moderate usage in the ecosystem

Community31

Small or concentrated contributor base

Maturity67

Established project with proven stability

 Bus Factor1

Top contributor holds 80.5% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~106 days

Recently: every ~101 days

Total

24

Last Release

306d ago

Major Versions

v3.0.0 → v4.0.02019-07-03

v4.4.1 → v5.0.02021-04-20

v5.0.1 → v6.0.02022-05-16

v6.5.0 → v7.0.02024-06-07

v7.0.0 → v8.0.02024-07-03

PHP version history (2 changes)v1.0.0PHP >=7.1

v5.0.0PHP >=7.2

### Community

Maintainers

![](https://www.gravatar.com/avatar/c580cdf7c14898fff179cdfc1085892091d5d2f49d917873a12365af9ac77c93?d=identicon)[Jord-JD](/maintainers/Jord-JD)

![](https://www.gravatar.com/avatar/250ad189b21ef862e3f0727fc0e416deb51588f7681ec35792327b1bd500e9ca?d=identicon)[langleyfoxall](/maintainers/langleyfoxall)

---

Top Contributors

[![Jord-JD](https://avatars.githubusercontent.com/u/650645?v=4)](https://github.com/Jord-JD "Jord-JD (99 commits)")[![jameswilddev](https://avatars.githubusercontent.com/u/3138458?v=4)](https://github.com/jameswilddev "jameswilddev (12 commits)")[![SteJaySulli](https://avatars.githubusercontent.com/u/60765965?v=4)](https://github.com/SteJaySulli "SteJaySulli (5 commits)")[![LNCH](https://avatars.githubusercontent.com/u/10821244?v=4)](https://github.com/LNCH "LNCH (3 commits)")[![lloricode](https://avatars.githubusercontent.com/u/8251344?v=4)](https://github.com/lloricode "lloricode (1 commits)")[![laravel-shift](https://avatars.githubusercontent.com/u/15991828?v=4)](https://github.com/laravel-shift "laravel-shift (1 commits)")[![Warren-CB](https://avatars.githubusercontent.com/u/126696209?v=4)](https://github.com/Warren-CB "Warren-CB (1 commits)")[![ziming](https://avatars.githubusercontent.com/u/679513?v=4)](https://github.com/ziming "ziming (1 commits)")

---

Tags

laravel-packagelaravel-validationnistnist800-63bpassword-strengthpasswordssecurity

### Embed Badge

![Health badge](/badges/langleyfoxall-laravel-nist-password-rules/health.svg)

```
[![Health](https://phpackages.com/badges/langleyfoxall-laravel-nist-password-rules/health.svg)](https://phpackages.com/packages/langleyfoxall-laravel-nist-password-rules)
```

###  Alternatives

[soved/laravel-gdpr

GDPR compliance with ease

299127.5k2](/packages/soved-laravel-gdpr)[masterro/laravel-xss-filter

Filter user input for XSS but don't touch other html

41254.5k](/packages/masterro-laravel-xss-filter)[enlightn/laravel-security-checker

A Laravel package to scan your dependencies for known security vulnerabilities.

51173.4k](/packages/enlightn-laravel-security-checker)[nickurt/laravel-pwned-passwords

PwnedPasswords for Laravel 11.x/12.x/13.x

187.5k](/packages/nickurt-laravel-pwned-passwords)[dgtlss/owaspadvisor

A Laravel package to help developers implement OWASP Top 10 security guidelines

327.1k](/packages/dgtlss-owaspadvisor)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)