PHP Passwords

Open-source PHP projects categorized as Passwords

Top 10 PHP Password Projects

  • Password Compat

    Compatibility with the password_* functions that ship with PHP 5.5

    Project mention: WordPlate: WordPress on Composer with sensible defaults | | 2023-02-25

    > Same for WordPress.

    Not as much - WP favours backwards compatibility (or is it laziness?) even when doing so impacts security.

    Another problem is that the environments Wordpress targets are inherently vulnerable - while it's not WP's fault directly, they do nothing to warn people against using them nor outright stop supporting broken, insecure configurations.

    > There are multitudes of comments that specifically single out WP in the post's comment thread. Including this very thread that you are on.

    I was talking about publicized data breaches in general. But if we specifically talk about CMSes, I'm not sure anything else beats Wordpress and similar PHP-based CMSes of that era when it comes to not just the amount of vulnerabilities, but especially the nature of them - the same, dumb, basic problems resolved in every other language (including modern PHP with a framework such as Laravel) repeated over and over again.

    > WHERE is that objective study that compares WordPress with other software in regard to vulnerabilities

    Someone posted the following excerpt of the Wordpress codebase, which appears to be some custom attempt at simulating SQL query parameterization instead of using the actual, database-driver-provided function. If this is indeed the purpose of that function and it is indeed used, then I'm not sure there is any valid excuse for this in today's day and age.

    Someone else mentioned password hashing still relying on MD5 - if that is actually true, I'm not sure that is excusable either? I haven't done PHP for many years now, but surely even if the native functions aren't available, couldn't they use a "polyfill" such as ?

    I'm sure there are many other issues but frankly the first one should be enough for any competent developer to run away.

    > No it doesnt. Dont make up falsities. PHP executes files how you configure it to.

    I was with you until this, but now I think you're arguing in bad faith.

    Yes, if you want to be pedantic, PHP and your web server execute files like how you configure them to. In practice, the environment where the vast majority of Wordpress sites are deployed (your typical shared hosting environment) will execute anything that ends with .php and is in the web root.

    This is inherently a legacy PHP problem (which WP encourages by supporting it) - no other language that I know of does this by default. If I accidentally store a malicious file in Python, Ruby, Node.js, etc applications, the worst that will happen is that I serve it back. At no point what so ever the server itself will execute that file.

    Yet in the PHP environments Wordpress targets, this is a massive issue which means every single feature handling file uploads (both in WP core and any plugins) should anticipate your server's misconfiguration (maybe it's not limited to .php files, but .html files too?) and try to protect against it, eventually failing and then you get yet another Wordpress vulnerability.

  • hashtopolis

    Hashtopolis - A Hashcat wrapper for distributed hashcracking

    Project mention: (Steel Battalion Line of Contact Official XDK Debug Build) Hey guys its RazorStoJ here. We are closer than ever to getting the debug build of Steel Battalion: Line of Contact, however we need your help! Please read below as we want the OG Xbox community to come together to help our Xbox game at SBO! | | 2023-03-29

    Thank you for trying <3 Gonna check on the discord and see if we can point that 4090 of yours at something else. /u/BombBloke had the good idea to split up who works on what as we think the first letter is a capital So yeah I'll see if I can build a set of commands for this and the adjusted character set we are talking about there. The discord is also talking about using something like this to set up a pool server as well so we can actually work together Just gotta work out hosting.

  • InfluxDB

    Access the most powerful time series database as a service. Ingest, store, & analyze all types of time series data in a fully-managed, purpose-built database. Keep data forever with low-cost storage and superior data compression.

  • Zxcvbn PHP

    Realistic PHP password strength estimate library based on Zxcvbn JS

  • PHP Password Lib

    A library for generating and validating passwords

  • Password-Generator

    PHP Library to generate random passwords

  • password_exposed

    🔒 Password Exposed Helper Function - Check if a password has been exposed in a data breach.

    Project mention: What We Do in the /etc./Shadow – Cryptography with Passwords | | 2023-01-06

    > There's another end of all this that I also never see addressed in writeups like this one: lots of users are still really bad at passwords.

    Author here.

    I was originally planning to write a blog post about my experience reporting cryptography-related bugs to password managers in 2022. (I had findings for LastPass, 1Password, and Keeper.)

    My experience with LastPass was abysmal. I wrote a thread about it here:

    However, I found in my early draft that I spent a lot of time explaining these algorithms, so I decided to spin it off into a separate article. Thus, this post was conceived!

    > Readers capable of implementing something like OPAQUE will already have a pretty good handle on most of what's written here. All other developers will just grab whatever "the" off-the-shelf solution is for their language and tech stack, and any recommendations for those are conspicuously absent here. What are the best resources for the most popular tech stacks currently? PHP introduced the password_hash() function (and related functions) in its standard library a while back. It defaults to bcrypt, and most php devs should probably just use those functions, unless they're sure they know better.

    I tried to make the post a good balance of fun and informative, but the audience was "people who want to know more about cryptography with passwords" not specifically developers.

    As you indicated, if you're developing something, the password_hash() / password_verify() API your language provides is likely 1000x safer than rolling your own anything. If there is to be improvements in the cryptography for a given programming language, it should be an update to whatever the de facto standard library is for that language.

    PHP has the password extension built-in. Python has passlib. Node has the crypto module. Etc.

    > For a while, some misguided sites tried to prevent people from pasting passwords into their login forms. I have never seen the inverse: a site that prevents users from typing a password. Is there a reason that wouldn't work?

    I'm not confident in this, since it's 4:46 AM for me and I should probably be sleeping instead of reading HN comments, but isn't this exactly how Passkey is supposed to work?

    Anyway, thanks for your insightful feedback. I already planned a teardown into the reverse-engineered internals of popular password managers and my experiences with them. Because of your comment, I might also make a future blog post targeting developers.

    In the meantime, here's some cool stuff: - A reasonable approach to password strength estimation (although I think their calculation needs updating in 2023) - Checks if a given password has been exposed in a previous breach (uses the HIBP hash database)

  • passwords

    A simple, yet feature rich password manager for Nextcloud (by marius-wieschollek)

    Project mention: Nextcloud Hub 3/25 Known App Incompatibilities | | 2022-10-21

    Passwords: Clicking on the app does not give you your passwords listing. The sidebar populates properly but no passwords show up. Marius has stated that these are due to styling changes made in Nextcloud 25 and that he has nightly builds that fix it enough to get it working again, however not to expect a stable version with these fixes quite yet. The Chrome extension appears to continue working just fine. Keep track of what is going on here:


    ONLYOFFICE Docs — document collaboration in your environment. Powerful document editing and collaboration in your app or environment. Ultimate security, API and 30+ ready connectors, SaaS or on-premises

  • Password Validator

    Validates passwords against PHP's password_hash function using PASSWORD_DEFAULT. Will rehash when needed, and will upgrade legacy passwords with the Upgrade decorator.

  • GenPhrase

    GenPhrase is a secure passphrase generator for PHP applications.

  • Password Policy

    A password policy enforcer for PHP and JavaScript

NOTE: The open source projects on this list are ordered by number of github stars. The number of mentions indicates repo mentiontions in the last 12 Months or since we started tracking (Dec 2020). The latest post mention was on 2023-03-29.

PHP Passwords related posts


What are some of the best open-source Password projects in PHP? This list will help you:

Project Stars
1 Password Compat 2,156
2 hashtopolis 1,174
3 Zxcvbn PHP 786
4 PHP Password Lib 372
5 Password-Generator 263
6 password_exposed 213
7 passwords 174
8 Password Validator 144
9 GenPhrase 112
10 Password Policy 74
TestGPT | Generating meaningful tests for busy devs
Get non-trivial tests (and trivial, too!) suggested right inside your IDE, so you can code smart, create more value, and stay confident when you push.