rebelinblue/laravel-zxcvbn

Service provider to use the zxcvbn project by @dropbox in Laravel 5.4 and above
69,829 11
laravel security validation passwords zxcvbn
Install
composer require rebelinblue/laravel-zxcvbn
Latest Version:1.6.0
PHP:>=8.0
License:MIT
Last Updated:Jun 29, 2025
Links: GitHub  ·  Packagist
Maintainer: REBELinBLUE

Laravel Zxcvbn validator

Build Status Code Coverage Software License

This package provides a validator which uses Dropbox's zxcvbn password strength estimator; it uses the PHP implementation from bjeavons.

Installation

This package can be installed through Composer.

composer require rebelinblue/laravel-zxcvbn

In Laravel 5.5 the package will auto-register the service provider. In Laravel 5.4 you must register this service provider manually in config/app.php by adding REBELinBLUE\Zxcvbn\ZxcvbnServiceProvider::class to the providers array

There is also an optional facade for Zxcvbn; in Laravel 5.5 it will be auto-registered. In Laravel 5.4 you must register the facade manually by adding the following to the aliases array in config/app.php

    'Zxcvbn' => REBELinBLUE\Zxcvbn\ZxcvbnFacade::class,

Optionally, you can publish the translations for this package with, however it is only required if you wish to change them

php artisan vendor:publish --provider="REBELinBLUE\Zxcvbn\ZxcvbnServiceProvider"

Usage

If you have added the alias you can access Zxcvbn from anywhere in your code using the façade

<?php

use Zxcvbn;

class MyCustomClass
{
    public function someMethod()
    {
        $strength = Zxcvbn::passwordStrength('Pa$$w0rd');
        dd($strength);
    }    
}

However, you probably want to use it as a validator. The package add a single rule "zxcvbn"

Example

<?php

$input = [ /* user input */ ];
$validator = Validator::make($input, [
    'password' => 'required|min:6|zxcvbn',
]);

There are 2 optional parameters, the required score from 0 to 4 and a comma separate list of other fields to compare against, for example to ensure a strong password which doesn't contain the username or email you would use

'password' => 'required|min:6|zxcvbn:4,username,email',

The scores are rated as follows:

  • 0 - Too guessable: risky password. (guesses < 10^3)
  • 1 - Very guessable: protection from throttled online attacks. (guesses < 10^6)
  • 2 - Somewhat guessable: protection from unthrottled online attacks. (guesses < 10^8)
  • 3 - Safely unguessable: moderate protection from offline slow-hash scenario. (guesses < 10^10)
  • 4 - Very unguessable: strong protection from offline slow-hash scenario. (guesses >= 10^10)

Related Packages

olssonm/l5-zxcvbn

Implementation of the zxcvbn project by @dropbox for Laravel 5. Uses zxcvbn-php...

352,349 29
laravel olssonm passwords security staple horse battery validation zxcvbn
tommyknocker/pdo-database-class

Framework-agnostic PHP database library with unified API for MySQL, MariaDB, Pos...

6,323 82
activerecord ai-analysis ai-database-assistant ai-powered anthropic batch-processing bulk-operations cli-tools common-table-expressions connection-pooling connection-retry cross-apply cross-platform csv-loader cte cursor-pagination database database-abstraction-layer database-optimization-ai dbal ddl deepseek delete-join dialect-specific-types distinct-on dump error-diagnostics event-dispatcher except exception-hierarchy explain-analysis export-helpers filter-clause fluent-api framework-agnostic full-text-search google-ai helper-functions insert-select intersect json-loader lateral-join lightweight load-balancing mariadb merge-statements microsoft-ai migrations mssql mysql ollama openai oracle orm outer-apply pagination pdo pdo-db pdo-oci pdodb performance php8 plugin-system postgresql prepared-statements psr-14 psr-16 query-builder query-caching query-compilation-cache query-debugging query-macros query-monitoring query-optimization-ai query-profiling query-scopes read-write-splitting recursive-cte regexp relationships restore savepoints schema-builder schema-inspector schema-introspection security seeds set-operations sharding sql-builder sql-formatter sql-injection sql-server sqlite table-locking transactions type-safe union update-join upsert user-management validation window-functions xml-loader yandex-ai yii2-inspired zero-dependencies
unicodeveloper/laravel-password

Protect your users from entering dumb and common passwords

1,540,398 425
dumb passwords security unicodeveloper
snipify-dev/laravel-captcha

A comprehensive Laravel package for integrating Google reCAPTCHA v2 and v3 with...

67 0
captcha laravel livewire recaptcha security validation
martian/spammailchecker

A laravel package that protect users from entering non-existing/spam email addre...

2,501 43
checker email github laravel martian package php security spam spamfree spammailchecker validation

Version History

Version Released PHP Laravel License
1.6.0 >=8.0 >=5.4 MIT
1.5.0 >=8.0 ^5.4||^6.0||^7.0||^8.0||^9.0||^10.0 MIT
1.4.0 >=7.2 ^5.4||^6.0||^7.0||^8.0||^9.0 MIT
1.3.0 >=7.2 ^5.4||^6.0||^7.0||^8.0 MIT
1.2.2 >=5.6 ^5.4||^6.0||^7.0||^8.0 MIT