PHPackages square1/pwned-check-laravel - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. square1/pwned-check-laravel ActiveLibrary[Security](/categories/security) square1/pwned-check-laravel =========================== Validate password changes against known-compromised passwords 1.2.1(3y ago)218.6k—5.1%3MITPHPPHP >=7.0 Since Mar 12Pushed 3y ago4 watchersCompare [ Source](https://github.com/square1-io/pwned-check-laravel)[ Packagist](https://packagist.org/packages/square1/pwned-check-laravel)[ Docs](https://github.com/square1-io/pwned-check-laravel)[ RSS](/packages/square1-pwned-check-laravel/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (2)Dependencies (1)Versions (7)Used By (0) Pwned Check Validator for Laravel ================================= [](#pwned-check-validator-for-laravel) Laravel validation rule to determine whether a password has appeared in a set of known compromised passwords. This is a PHP wrapper for the [Pwned Check](https://github.com/square1-io/pwned-check) utility class, making use of the [Pwned Passwords](https://haveibeenpwned.com/Passwords) service provided by [Troy Hunt](https://www.troyhunt.com/). Install ------- [](#install) Via Composer ``` $ composer require square1/pwned-check-laravel ``` ### Laravel 5.5+ [](#laravel-55) If you're using Laravel 5.5+, then the package will be auto-discovered. ### Laravel <= 5.4 [](#laravel--54) To use the Pwned Check validation rule, you must register the provider when bootstrapping your Laravel application. Find the `providers` key in your `config/app.php` and add the below. ``` 'providers' => array( // ... Square1\Laravel\PwnedCheck\Providers\PwnedCheckServiceProvider::class, ) ``` ### Publishing config file [](#publishing-config-file) ``` php artisan vendor:publish --provider="Square1\Laravel\PwnedCheck\Providers\PwnedCheckServiceProvider" --tag=config ``` This will publish the configuration file to `pwned-check.php`. Configuration Options --------------------- [](#configuration-options) A number of configuration options are available to modify the behaviour of the class. OptionDefaultComment`endpoint``https://api.pwnedpasswords.com/range/`Service endpoint url`user_agent``Square1 Pwned PHP package`User agent to use - api calls without a user agent are rejected`connection_timeout``0`Initial curl connection limit (0 for off). If connection takes longer than X seconds to establish, it's terminated`remote_processing_timeout``0`Number of seconds after which to kill a slow-responding connection (0 for off)`minimum_occurrences``1`Minimum number of times a password needs to appear in breaches before being considered compromisedUsage ----- [](#usage) ``` // RegisteredUserController.php public function store(Request $request) { $request->validate([ 'name' => ['required', 'string', 'max:255'], 'email' => ['required', 'string', 'email', 'max:255', 'unique:'.User::class], 'password' => ['required', 'confirmed', Rules\Password::defaults(), 'pwned'], ]); // ... // Reject any password that has appeared in the list of compromised ones more than ten times 'password' => ['required', 'confirmed', Rules\Password::defaults(), 'pwned:10'], ``` FAQ --- [](#faq) ### How do I set the validation error message shown? [](#how-do-i-set-the-validation-error-message-shown) In the `lang/{LANG}/validation` for each language your app runs in, the message can be set within the `custom` array: ``` 'custom' => [ 'password' => [ 'pwned' => 'The :attribute has appeared in a known set of compromised passwords. Please choose a different password.', ], ], ``` ### How do you decide if a password is "known compromised"? [](#how-do-you-decide-if-a-password-is-known-compromised) The [Pwned Passwords](https://haveibeenpwned.com/Passwords) service provided by [Troy Hunt](https://www.troyhunt.com/) is a great resource that aggregates passwords found in known data breaches. The api allows us to check whether a password has appeared in previous data breaches, and also how frequently it shows up. The frequency allows us to decide how strict we want to be when deciding if a password is to be considered compromised. For example, `abcd1234` may show up 334,000 times in data breaches, while `totallyuniqueandrandompass1234` may only show up once. Depending on your use case, it may be appropriate to only blacklist widely compromised passwords. The frequency count is what allows us to do this. ### Does sending a password to the service not constitute a security risk? [](#does-sending-a-password-to-the-service-not-constitute-a-security-risk) The Pwned password api allows for range queries to be made. This involves hashing the password via this library within your application, and sending a partial section of it to the api. The api returns a set of password hashes (and frequency counts for each). These can then be matched against the full password hash, which never needs to leave the application. Cloudflare worked closely with Troy on the design of this api, and go into a lot more detail on this approach to using k-anonymity in [this blog post](https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/). ### What if the api server is slow to respond? Will my app have problems? [](#what-if-the-api-server-is-slow-to-respond-will-my-app-have-problems) Typical api responses are blazingly-fast - the article [here](https://www.troyhunt.com/i-wanna-go-fast-why-searching-through-500m-pwned-passwords-is-so-quick/) is worth a read. However, it's possible that at some point there'll be a connection issue or some other performance issue with the service. To protect your app in these cases, you can set the `connection_timeout` and `remote_processing_timeout` config values. These are the seconds to wait before killing a curl connection and wait time after connection respectively. If the service call is terminated due to one of these timeouts being reached, a `Square1\Pwned\Exception\ConnectionFailedException` will be thrown. ### If the api does time out, does that behave the same as if the password is compromised? [](#if-the-api-does-time-out-does-that-behave-the-same-as-if-the-password-is-compromised) This can be controlled through the `fail_on_timeout` config value. When it is set to `true`, any connection failure will be treated as a validation failure. However, you may wish to have this compromised check as a less critical one, so in the event of a remote service failure you'd prefer that your user registration continues unimpacted. Setting this value to `false` will mean that a connection failure won't trigger a validation failure. ### Are the api results cached? [](#are-the-api-results-cached) The api results are cached for a day by default. This value can be altered in the `cache_default_ttl` config variable. License ------- [](#license) The MIT License (MIT). Please see [License File](LICENSE.md) for more information. ### Health Score 35 — LowBetter than 80% of packages Maintenance20 Infrequent updates — may be unmaintained Popularity31 Limited adoption so far Community11 Small or concentrated contributor base Maturity62 Established project with proven stability Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~570 days Total 4 Last Release 1280d ago PHP version history (2 changes)1.0PHP >=7.0.0 1.2PHP >=7.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/5a6096b0455d662c5963ed82e1f0968bc4a18bdfedd332f7fd2598480b4c17bd?d=identicon)[conroyp](/maintainers/conroyp) --- Top Contributors [![conroyp](https://avatars.githubusercontent.com/u/143244?v=4)](https://github.com/conroyp "conroyp (7 commits)") --- Tags laravelsecuritypasswordsquare1pwned-check ### Embed Badge ![Health badge](/badges/square1-pwned-check-laravel/health.svg) ``` [![Health](https://phpackages.com/badges/square1-pwned-check-laravel/health.svg)](https://phpackages.com/packages/square1-pwned-check-laravel) ``` ### Alternatives [akaunting/laravel-firewall Web Application Firewall (WAF) package for Laravel 999465.8k2](/packages/akaunting-laravel-firewall)[olssonm/laravel-backup-shield Protection for your laravel backups 3019.5k](/packages/olssonm-laravel-backup-shield)[enlightn/laravel-security-checker A Laravel package to scan your dependencies for known security vulnerabilities. 51173.4k](/packages/enlightn-laravel-security-checker)[nicobleiler/php-passphrase Passphrase generator with Laravel integration, inspired by Bitwarden. Uses the EFF long word list by default with support for custom wordlists. 451.7k](/packages/nicobleiler-php-passphrase)[pentagonal/phpass PHP password hashing library original by open wall PhPass 121.6k](/packages/pentagonal-phpass) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)