Add a Check For Pwned Passwords In Your Laravel Form Validation

Have I been pwned? is a service created by Troy Hunt that aims to archive all data breaches and then allow you to check and see if your email or username has been included in any breaches. It’s a super helpful service and with 4,948,721,769, at the time of this writing, pwned accounts included it’s one of the most comprehensive lists around.

To go along with this check for email/username the service also allows you to search passwords and see if they’ve been breached. This recently received a huge upgrade that makes available half a billion passwords and available through an API.

Stephen Rees-Carter has built a Laravel package that hooks into this for form validation so you can now ensure your users aren’t using pwned passwords.

After you install the package, the pwned validator will be available for use directly in your validation rules like this:

'password' => 'pwned',

Another new feature in the version 2 of Pwned Passwords is the ability to see how many times a password has been used. Stephen hooked into this with so you could have a minimum check in place.

For example, password has been pwned 3,303,003 times, however P@ssword! has only been pwned 118 times. If we wanted to block password but not P@ssword!, we can specify the minimum number as 150 like this:

'password' => 'required|string|min:6|pwned:150',

When working with something security will be of the utmost importance and here is how it works:

This uses the ranged search feature of the Pwned Passwords API, which uses k-anonymity to significantly reduce the risk of any information leakage when accessing the API. For most systems, this should be more than secure enough, although you should definitely decide for yourself if it’s suitable for your app.