Password Strength Bundle

⭐ Found this useful? Give it a star on GitHub so more developers can find it.

Symfony bundle that extends PasswordType with 100% configurable password hardness: predefined levels, inline conditions, auto-built HTML pattern, live TypeScript feedback, and a validator constraint.

This bundle is FrankenPHP worker mode friendly.

Table of contents

• Features
• Installation
• Requirements
• Configuration
• Usage
• PasswordToggleBundle compatibility (optional)
• Demo
• Documentation
• Tests and coverage
• License

Features

• PasswordStrengthType — extends Symfony PasswordType
• Policy modes — level (weak/medium/strong/custom) or inline conditions
• HTML pattern — built automatically from the active policy
• Live feedback — TypeScript evaluates requirements and shows what is missing
• Feedback position — configurable above or below the input
• PasswordStrength validator — server-side enforcement with the same rules
• Multi-framework Twig themes — Bootstrap 3–5, Tailwind 2, Foundation 5–6, table/div layouts
• PasswordToggleBundle — optional show/hide toggle when that bundle is installed (auto-detected)
• Vite + pnpm + TypeScript assets (IIFE bundle for assets:install)
• Translations — DE, EN, ES, FR, IT, NL, PT (overridable from the app)

Installation

composer require nowo-tech/password-strength-bundle

Register the bundle (Flex does this automatically):

Nowo\PasswordStrengthBundle\PasswordStrengthBundle::class => ['all' => true],

Install public assets:

php bin/console assets:install

Include the script in your layout (or demo template):

<script src="{{ asset('password-strength.js', 'nowo_password_strength') }}" defer></script>

Requirements

• PHP >= 8.1, < 8.6
• Symfony >= 6.0 || >= 7.0 || >= 8.0

Configuration

# config/packages/nowo_password_strength.yaml
nowo_password_strength:
  form_theme: bootstrap_5_layout.html.twig  # match your app layout
  feedback_position: below
  show_requirements: true
  live_feedback: true
  default_level: medium
  levels:
    weak:
      min_length: 6
    medium:
      min_length: 8
      require_lowercase: true
      require_uppercase: true
      require_digit: true
    strong:
      min_length: 12
      require_lowercase: true
      require_uppercase: true
      require_digit: true
      require_special: true
  use_password_toggle: true   # optional; auto-uses toggle when PasswordToggleBundle is installed
  # parent_form_type: ~      # null = auto; or set a FQCN to force a specific parent PasswordType
  generator_mode: off

Usage

use Nowo\PasswordStrengthBundle\Form\PasswordStrengthType;

$builder->add('plainPassword', PasswordStrengthType::class, [
    'policy_mode' => 'level',
    'level' => 'strong',
    'feedback_position' => 'below',
    'ui_framework' => 'bootstrap5',
]);

Form type (inline conditions)

$builder->add('plainPassword', PasswordStrengthType::class, [
    'policy_mode' => 'conditions',
    'conditions' => [ /* ... */ ],
    'generator_mode' => 'modal',  // off | input | modal
    'generator_count' => 4,       // suggestions in modal
]);

Generator modes:

• off — no generator (default)
• input — one click fills the field as visible text
• modal — opens a dialog with suggestions, copy and “Use this password”

Validator constraint

use Nowo\PasswordStrengthBundle\Validator\PasswordStrength;

#[PasswordStrength(policyMode: 'level', level: 'medium')]
public ?string $plainPassword = null;

Available condition keys

Key	Type	Description
min_length	int	Minimum length
max_length	int	Maximum length
require_lowercase	bool	At least one a-z
require_uppercase	bool	At least one A-Z
require_digit	bool	At least one digit
require_special	bool	At least one special char
special_chars	string	Charset for special chars
disallow_whitespace	bool	No spaces
not_contain	string[]	Forbidden substrings
min_unique_chars	int	Minimum unique characters
regex	string	Custom regex (server + pattern)

PasswordToggleBundle compatibility (optional)

PasswordToggleBundle is not required. With default settings the bundle works standalone using Symfony PasswordType.

When PasswordToggleBundle is installed, PasswordStrengthType automatically extends its PasswordType and renders the eye toggle alongside strength feedback and the optional password generator.

composer require nowo-tech/password-toggle-bundle symfony/ux-icons symfony/http-client

nowo_password_strength:
  use_password_toggle: true   # default; ignored if parent_form_type is set explicitly
  # Force Symfony parent even when PasswordToggleBundle is installed:
  # parent_form_type: Symfony\Component\Form\Extension\Core\Type\PasswordType
  # Force PasswordToggle parent (requires the bundle):
  # parent_form_type: Nowo\PasswordToggleBundle\Form\Type\PasswordType

nowo_password_toggle:
  toggle: true
  visible_icon: 'tabler:eye-off'
  hidden_icon: 'tabler:eye'

Per field:

$builder->add('password', PasswordStrengthType::class, [
    'use_password_toggle' => true,  // false = plain password input
    'generator_mode' => 'input',
]);

The generator syncs toggle icon/aria state when it fills the field as visible text.

Demo

make -C demo up
# or: make -C demo/symfony8 up

Open http://localhost:8021/en/ (redirect from /; set PORT in demo/symfony8/.env if needed).

Documentation

• GitHub Actions CI requirements
• Installation
• Configuration
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• Demo with FrankenPHP
• Demo (Symfony 8)

Tests and coverage

Language	Coverage (approx.)
PHP	~99% lines (make test-coverage)
TypeScript	~90% (make test-ts)

make test
make test-ts
make test-coverage

License

MIT — see LICENSE.