PHPackages valorin/pwned-validator - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. valorin/pwned-validator ActiveLibrary valorin/pwned-validator ======================= Super simple Laravel Validator for checking password via the Pwned Passwords service of Have I Been Pwned 1.3.9(2mo ago)3871.4M↓44.6%23[2 issues](https://github.com/valorin/pwned-validator/issues)1MITPHPPHP >=7.2 Since Feb 23Pushed 2mo ago11 watchersCompare [ Source](https://github.com/valorin/pwned-validator)[ Packagist](https://packagist.org/packages/valorin/pwned-validator)[ GitHub Sponsors](https://github.com/valorin)[ RSS](/packages/valorin-pwned-validator/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (7)Dependencies (1)Versions (15)Used By (1) Pwned Passwords Validator for Laravel ===================================== [](#pwned-passwords-validator-for-laravel) **Laravel includes an official Pwned Passwords validator via the `Password::uncompromised()` validation rule, so I recommend checking that out instead: ** The Pwned Password validator checks the user's submitted password (in a registration or password change form) with the awesome [HIBP Pwned Passwords](https://haveibeenpwned.com/Passwords) service to see if it is a known *pwned password*. If the password has been pwned, it will fail validation, preventing the user from using that password in your app. > Pwned Passwords are half a billion real world passwords previously exposed in data breaches. This exposure makes them unsuitable for ongoing use as they're at much greater risk of being used to take over other accounts. This uses the *ranged search* feature of the Pwned Passwords API, which uses [k-anonymity](https://en.wikipedia.org/wiki/K-anonymity)to significantly reduce the risk of any information leakage when accessing the API. For most systems this should be more than secure enough, although you should definitely decide for yourself if it's suitable for your app. Please make sure to check out the blog post by Troy Hunt, where he explains how the service works: . Troy worked with Cloudflare on this service, and they have an in depth technical analysis on how it works and the security implications: . Ultimately, it's up to you to decide if it's safe for your app or not. Installation ------------ [](#installation) Install the package using Composer: ``` composer require valorin/pwned-validator ``` Laravel's service provider discovery will automatically configure the Pwned service provider for you. Add the validation message to your validation lang file: For each language add a validation message to `validation.php` like below ``` 'pwned' => 'The :attribute is not secure enough', ``` Using the `pwned` validator --------------------------- [](#using-the-pwned-validator) After installation, the `pwned` validator will be available for use directly in your validation rules. ``` 'password' => 'pwned', ``` Within the context of a registration form, it would look like this: ``` return Validator::make($data, [ 'name' => 'required|string|max:255', 'email' => 'required|string|email|max:255|unique:users', 'password' => 'required|string|min:6|pwned|confirmed', ]); ``` Using the Rule Object --------------------- [](#using-the-rule-object) Alternatively, you can use the `Valorin\Pwned\Pwned` [Validation Rule Object](https://laravel.com/docs/5.5/validation#using-rule-objects)instead of the `pwned` alias if you prefer: ``` return Validator::make($data, [ 'name' => 'required|string|max:255', 'email' => 'required|string|email|max:255|unique:users', 'password' => ['required', 'string', 'min:6', new \Valorin\Pwned\Pwned, 'confirmed'], ]); ``` Validation message ------------------ [](#validation-message) You will need to assign your own validation message within the `resources/lang/*/validation.php` file(s). Both the Rule object and the `pwned` validator alias refer to the validation string `validation.pwned`. I haven't set a default language string as it is important you get the language right for your intended users. In some systems a message like `Your password has been pwned! Please use a new one!` is suitable, while in other systems you'd be better with something a lot longer: > Your password is insufficiently secure as it has been found in known password breaches, please choose a new one. [Need help?](#) Thanks to [kanalumaddela](https://github.com/valorin/pwned-validator/pull/2), you can use `:min` in the message to indicate the minimum number of times found set on the validator. > Your password is insufficiently secure as it has been found at least :min times in known password breaches, please choose a new one. Limiting by the number of times the password was pwned ------------------------------------------------------ [](#limiting-by-the-number-of-times-the-password-was-pwned) You can also limit rejected passwords to those that have been pwned a minimum number of times. For example, `password` has been pwned 3,303,003 times, however `P@ssword!` has only been pwned 118 times. If we wanted to block `password` but not `P@ssword!`, we can specify the minimum number as 150 like this: ``` 'password' => 'required|string|min:6|pwned:150|confirmed', ``` or using the Rule object: ``` 'password' => ['required', 'string', 'min:6', new \Valorin\Pwned\Pwned(150), 'confirmed'], ``` FAQs ---- [](#faqs) Q: How secure is this? A: Please check the above linked blog posts by Troy Hunt and Cloudflare, as they will answer your question and help you decide if it's safe enough for you. Q: Do you do any caching? A: Yep! Each prefix query is cached for a week, to prevent constant API requests if the same prefix is checked multiple times. Q: Where are the tests? A: To properly test this code, we need to hit the web service. I don't want to automate that, to avoid abusing this fantastic service. Instead, since it is an incredibly simplistic validator, I've opted to manually test it for now. ### Health Score 62 — FairBetter than 99% of packages Maintenance83 Actively maintained with recent releases Popularity59 Moderate usage in the ecosystem Community26 Small or concentrated contributor base Maturity66 Established project with proven stability Bus Factor1 Top contributor holds 69.6% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~224 days Recently: every ~364 days Total 14 Last Release 85d ago PHP version history (2 changes)1.0.0PHP >=7.1.3 1.3.0PHP >=7.2 ### Community Maintainers ![](https://www.gravatar.com/avatar/6c2eb86dddee75463a43c6457f38413b61cc0009232881df800a3842e2d89f7b?d=identicon)[valorin](/maintainers/valorin) --- Top Contributors [![valorin](https://avatars.githubusercontent.com/u/897369?v=4)](https://github.com/valorin "valorin (32 commits)")[![laravel-shift](https://avatars.githubusercontent.com/u/15991828?v=4)](https://github.com/laravel-shift "laravel-shift (4 commits)")[![lsfiege](https://avatars.githubusercontent.com/u/13440507?v=4)](https://github.com/lsfiege "lsfiege (2 commits)")[![kanalumaddela](https://avatars.githubusercontent.com/u/14265751?v=4)](https://github.com/kanalumaddela "kanalumaddela (2 commits)")[![SamuelNitsche](https://avatars.githubusercontent.com/u/24483576?v=4)](https://github.com/SamuelNitsche "SamuelNitsche (1 commits)")[![tehCh0nG](https://avatars.githubusercontent.com/u/7266357?v=4)](https://github.com/tehCh0nG "tehCh0nG (1 commits)")[![mralston](https://avatars.githubusercontent.com/u/248387?v=4)](https://github.com/mralston "mralston (1 commits)")[![jny986](https://avatars.githubusercontent.com/u/37679074?v=4)](https://github.com/jny986 "jny986 (1 commits)")[![CJDennis](https://avatars.githubusercontent.com/u/1551236?v=4)](https://github.com/CJDennis "CJDennis (1 commits)")[![pbarsallo](https://avatars.githubusercontent.com/u/29644270?v=4)](https://github.com/pbarsallo "pbarsallo (1 commits)") ### Embed Badge ![Health badge](/badges/valorin-pwned-validator/health.svg) ``` [![Health](https://phpackages.com/badges/valorin-pwned-validator/health.svg)](https://phpackages.com/packages/valorin-pwned-validator) ``` ### Alternatives [fumeapp/modeltyper Generate TypeScript interfaces from Laravel Models 196277.9k](/packages/fumeapp-modeltyper)[aedart/athenaeum Athenaeum is a mono repository; a collection of various PHP packages 245.2k](/packages/aedart-athenaeum) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)