README

Password strength validation with entropy calculation and common password detection.

Requirements

• PHP 8.2+

Installation

composer require philiprehberger/php-password-strength

Usage

Checking password strength

use PhilipRehberger\PasswordStrength\PasswordStrength;

$result = PasswordStrength::check('MyP@ssw0rd!2026');

echo $result->score;       // 0-4
echo $result->label();     // "very weak", "weak", "fair", "strong", or "very strong"
echo $result->entropy;     // Shannon entropy in bits
echo $result->isCommon;    // true if found in common passwords list
echo $result->length;      // Password length

// Improvement suggestions
foreach ($result->suggestions as $suggestion) {
    echo $suggestion;
}

// Array representation
$array = $result->toArray();

Quick validation

use PhilipRehberger\PasswordStrength\PasswordStrength;

// Returns true if score >= 3 (strong)
if (PasswordStrength::isStrong('MyP@ssw0rd!2026')) {
    echo 'Password is strong enough.';
}

// Custom minimum score
if (PasswordStrength::isStrong('MyP@ssw0rd!2026', minScore: 4)) {
    echo 'Password is very strong.';
}

Detailed analysis

use PhilipRehberger\PasswordStrength\PasswordStrength;

$report = PasswordStrength::analyze('MyP@ssw0rd!2026');

echo $report->score;             // 0-4
echo $report->level;             // "very weak", "weak", "fair", "strong", or "very strong"
echo $report->length;            // Password length
echo $report->hasLowercase;      // true
echo $report->hasUppercase;      // true
echo $report->hasDigits;         // true
echo $report->hasSymbols;        // true
echo $report->hasRepeatedChars;  // false
echo $report->hasSequentialChars; // false
echo $report->hasKeyboardPattern; // false

Custom dictionary

use PhilipRehberger\PasswordStrength\PasswordStrength;

PasswordStrength::addDictionary(['company', 'acme', 'internal']);

$result = PasswordStrength::check('acmepassword');
// Score reduced, suggestion: "Avoid dictionary words."

PasswordStrength::clearDictionaries();

Personal context checking

use PhilipRehberger\PasswordStrength\PasswordStrength;

$report = PasswordStrength::withContext(['john', 'john@example.com'])
    ->analyze('john2024!');

echo $report->hasPersonalContext; // true
// Suggestion: "Avoid using personal information in your password"

Policy-based validation

use PhilipRehberger\PasswordStrength\PasswordPolicy;
use PhilipRehberger\PasswordStrength\PasswordStrength;

$policy = (new PasswordPolicy)
    ->minLength(10)
    ->requireUppercase()
    ->requireDigits()
    ->requireSymbols()
    ->minScore(3);

// Using the policy directly
$policy->check('MyP@ssw0rd!2026'); // true

// Using the main class
PasswordStrength::meetsPolicy('MyP@ssw0rd!2026', $policy); // true
PasswordStrength::meetsPolicy('weak', $policy);             // false

API

PasswordStrength

StrengthResult

StrengthReport

PendingAnalysis

PasswordPolicy

Score Meanings

Development

composer install
vendor/bin/phpunit
vendor/bin/pint --test

Support

If you find this project useful:

⭐ Star the repo

🐛 Report issues

💡 Suggest features

❤️ Sponsor development

🌐 All Open Source Projects

💻 GitHub Profile

🔗 LinkedIn Profile

License

MIT