Skip to content


Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
A PHP library that implements secure "Remember me" cookies
branch: master

New release

Update the version number in composer.json
latest commit 861cb3ea60
Gabriel Birke authored

Secure "Remember Me"

This library implements the best practices for implementing a secure "Remember Me" functionality on web sites. Login information and unique secure tokens are stored in a cookie. If the user visits the site, the login information from the cookie is compared to information stored on the server. If the tokens match, the user is logged in. A user can have login cookies on several computers/browsers.

This library is heavily inspired by Barry Jaspan's article "Improved Persistent Login Cookie Best Practice". The library protects against the following attack scenarios:

  • The computer of a user is stolen or compromised, enabling the attacker to log in with the existing "Remember Me" cookie. The user knows this has happened. The user can remotely invalidate all login cookies.
  • An attacker has obtained the "Remember Me" cookie and has logged in with it. The user does not know this. The next time he tries to log in with the cookie that was stolen, he gets a warning and all login cookies are invalidated.
  • An attacker has obtained the database of login tokens from the server. The stored tokens are hashed so he can't use them without computational effort (rainbow tables or brute force).


composer require birke/rememberme

Usage example

See the example directory for an example.

Improving security

The generated tokens are pseudo-random and the storage classes use the SHA1 algorithm to hash them. If you need better security than that, overwrite the Authenticator::generateToken method to generate a truly random token. If you are using PHP >=5.5 you can use the "password_hash" and "password_verify" functions. On lower PHP versions you could use the userland implementations of these functions.

Something went wrong with that request. Please try again.