Download the PHP package farhad-arjmand/lumen-hash-generator without Composer
On this page you can find all versions of the php package farhad-arjmand/lumen-hash-generator. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download farhad-arjmand/lumen-hash-generator
More information about farhad-arjmand/lumen-hash-generator
Files in farhad-arjmand/lumen-hash-generator
Package lumen-hash-generator
Short Description Cryptographically secure tokens and public identifiers for PHP, with optional Laravel integration.
License MIT
Homepage https://github.com/farhad-arjmand/lumen-hash-generator
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package lumen-hash-generator
Secure tokens for PHP & Laravel
Generate unpredictable API tokens, invitation codes and public identifiers. Use the same small library in plain PHP, a Laravel application, or a terminal.
Version 2 is a breaking rewrite. The Composer package keeps its historical name, farhad-arjmand/lumen-hash-generator. It now generates random tokens, rather than hashing the current time. The legacy HTTP/JWT API is removed; read the migration guide before upgrading.
What it does
- Uses PHP's
random_bytes()and unbiasedrandom_int(). Fails closed if randomness is unavailable. - Produces alphanumeric, custom-alphabet, hex and unpadded Base64URL tokens.
- Enforces at least 128 bits of entropy in the random portion, including custom alphabets.
- Supports prefixes and bounded batches; no timestamps, static salts or pseudo-random fallback.
- Provides SHA-256 token digests and optional HMAC-SHA-256 with a separate pepper.
- Has no production Composer dependencies for plain PHP.
- Integrates with Laravel through dependency injection and a namespaced configuration file.
- Does not create users, register HTTP routes, run migrations, log tokens or change application authentication.
Installation
Install the stable v2 series:
If Packagist has not indexed the new tag yet, add the repository directly and repeat the command:
Requirements: PHP 8.2–8.5. The optional provider is tested with Laravel 12 (PHP 8.2+) and Laravel 13 (PHP 8.3+). Laravel 5 and the old Lumen HTTP API are not supported by this rewrite. The core can be called directly from other frameworks, including modern Lumen installations; no Lumen integration is claimed or tested.
For development from a checkout:
Choose a token format
| Method | Default random input | Default output length, excluding prefix |
|---|---|---|
generate() |
32 independent Base62 characters | 32 characters, about 190 bits |
hex() |
32 random bytes | 64 hexadecimal characters, 256 bits |
base64Url() |
32 random bytes | 43 URL-safe characters, 256 bits |
generate() accepts 2–94 distinct printable ASCII alphabet characters, excluding spaces. Its random length must provide at least 128 bits and cannot exceed 4,096 characters. For example, a binary alphabet needs at least 128 characters; a decimal alphabet needs 39. The default alphabet and Base64URL are URL-safe; a custom alphabet is not necessarily URL-safe.
Hex/Base64URL accept 16–1,024 random bytes. Prefixes accept up to 64 ASCII letters, digits, _ or -; prefixes add no entropy. Batches accept 1–1,000 tokens. Invalid options throw InvalidArgumentException; RNG failures propagate and must not be replaced with weaker randomness.
Randomness does not guarantee uniqueness. For persistent public identifiers, add a database unique constraint and retry a bounded number of times on a collision.
Store and verify bearer tokens
Digests are 64 lowercase hexadecimal characters. verify() rejects empty tokens and malformed digests. Optional keyed storage:
Use a high-entropy key. Key length alone does not establish key entropy. Keep it separate from the database and stable across workers. Changing it invalidates existing digests unless your application implements a versioned key rotation strategy.
This is not a password hasher, JWT issuer, encryption library or token-management service. Use password_hash()/Laravel's password hashing for passwords. Authentication, authorization, scopes, expiry, rate limiting, revocation and one-time consumption belong in your application. Do not send token values to logs, analytics, exception context or URLs. Prefer an established authentication system such as Laravel Sanctum when you need a complete API-token lifecycle.
Laravel
The service provider is discovered automatically. Constructor or route injection works with the concrete classes:
Configuration is optional:
The published config/hash-generator.php reads HASH_GENERATOR_PEPPER. Leave it unset for plain SHA-256 token digests. Config caching is supported. Rebuild configuration and restart long-lived workers after changing a pepper. The provider never replaces Laravel's hashing configuration or Hash facade.
For an HTTP use case, see the application-owned route example. It assumes Sanctum is already configured by the host application; the package does not install or configure it.
CLI
Options use --name=value; --json returns an array even for one token. Without JSON, each token is a line on stdout. Exit codes: 0 success, 2 invalid arguments, 1 runtime failure. Invalid or failed requests produce no token output. Avoid redirecting stdout to shared CI logs.
Verification and maintenance
CI runs unit and Laravel integration tests on PHP 8.2–8.5, checks syntax, validates Composer metadata and audits dependencies. It also checks installation into a separate plain-PHP consumer, including the Composer-installed executable. See SECURITY.md.
The randomness tests catch regressions such as the legacy time-based collisions; they are not a statistical certification of a cryptographic primitive. Security relies on PHP's operating-system-backed random functions.
MIT © Farhad Arjmand. See LICENSE.md.
