> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Default Password Rules
- URL: https://securinglaravel.com/security-tip-default-password-rules/
- Published: 2021-12-27T04:00:41.000Z
- Updated: 2024-10-10T06:32:00.000Z
- Description: [Tip #11] Why duplicate password validation rules across your app when you can define defaults once?
- Author: Stephen Rees-Carter
- Tags: Security Tips, Passwords, Input Validation, Validation

Password Rules are typically defined on a project or company level and then reused across an app, so you’ll probably find yourself copy-pasting the rules from one validator to another when building registration, password change, etc, and then if the rules ever change, you’ll have to bounce between all of the validators to update the rules. It doesn’t sound that hard, but it still takes effort, and if your app has multiple logins or registration forms, you’ll need to update and all of them…

Luckily for us, Laravel makes this easy!

Laravel’s [Password Validator](https://laravel.com/docs/validation?ref=securinglaravel.com#validating-passwords) includes the concept of **Default Password Rules**. You use it by defining your password rules once, usually in a Service Provider, and then you can simply refer to these rules in each validator as `Password::defaults()`.

Let’s define a basic minimum length:

```php
use Illuminate\Validation\Rules\Password;

class AppServiceProvider extends ServiceProvider
{
    // ...

    public function boot()
    {
        Password::defaults(fn () => Password::min(8));
    }
}
```

The validator can then look like this:

```
'password' => ['required', Password::defaults()],
```

**Now we can change our password rules, and the validator won’t change at all.**

Let's add in the `uncompromised()` rule, which checks the submitted password against *Have I Been Pwned's* [*Pwned Passwords*](https://haveibeenpwned.com/passwords?ref=securinglaravel.com) list.

Let's also only enable it on production:

```php
use Illuminate\Validation\Rules\Password;

class AppServiceProvider extends ServiceProvider
{
    public function boot()
    {
        Password::defaults(function () {
            $rule = Password::min(8);

            return $this->app->isProduction()
                ? $rule->uncompromised()
                : $rule;
        });
    }
}
```

Done! 

No changes needed for the validation rules in each controller/request. 😎

---

**Found this security tip helpful?* Don't forget to* [*subscribe*](https://securinglaravel.com/#/portal/signup) *to receive new* [*Security Tips*](https://securinglaravel.com/tag/tips/) *each week, and upgrade to a* [*premium subscription*](https://securinglaravel.com/#/portal/signup) *to receive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or toss a coin in the* [*tip jar*](https://securinglaravel.com/#/portal/support)*.*

*Reach out if you're looking for a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com) *or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*, and find me on the various socials through* [*Pinkary*](https://pinkary.com/@valorin?ref=securinglaravel.com)*. Finally, don't forget to check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive security course.*