Defining Default Password Validation Rules in Laravel

In Laravel 8.43, the Password Validation Rule Object now supports the ability to define default password rules you can use across your application.

The ability to define default password rules means that you can centralize the expected validation behavior for a password by defining them in a service provider (i.e., AppServiceProvider)

use Illuminate\Validation\Rules\Password;

/**
 * Bootstrap any application services.
 *
 * @return void
 */
public function boot()
{
    Password::defaults(function () {
        return Password::min(8)
                       ->mixedCase()
                       ->uncompromised();
    });
}

Defaults are stored, and you can retrieve them later on in a validator with the Password::defaults() method:

use Illuminate\Validation\Rules\Password;

$request->validate([
    'password' => ['required', Password::defaults()],
]);

The Password validation rule introduces convenient password conventions designed to enforce strong passwords, including checking if the password was compromised in known data leaks.

To learn more about this feature, check out the documentation on Defining Default Password Rules. See Validating Passwords for usage details on rules provided by the password validation object.