// the take
Sentinel is a standalone auth and authorization library for PHP 8.3+, built by Cartalyst mainly for Laravel but with framework-agnostic interfaces underneath. It's aimed at teams who want more structure than Laravel's built-in auth gives them out of the box: roles, permissions, activation/reminder flows, and brute-force throttling as first-class concepts rather than things you bolt on yourself.
Every concern (users, roles, permissions, persistence, activations, reminders, throttling) is behind an interface with both an Eloquent-backed implementation and a framework-agnostic one, so swapping ORM or dropping Laravel entirely is actually possible rather than theoretical. Checkpoints (ActivationCheckpoint, ThrottleCheckpoint) give you account-activation gating and login throttling as pluggable middleware-like hooks instead of code you'd otherwise hand-roll. Two permission-matching strategies (Standard vs Strict) cover both loose wildcard-style checks and exact-match enforcement without forcing one model on you. Hasher abstraction (bcrypt, native, callback, plus legacy sha256/whirlpool) makes migrating an existing user table with old password hashes straightforward.
Shipping sha256 and whirlpool hashers alongside bcrypt is a real foot-gun — they exist for migrating legacy systems, but nothing stops a new project from wiring one up and ending up with weak password storage. Each major version is hard-pinned to exactly one Laravel release (10.x only works with Laravel 13.0, 8.x only with 11.0, etc.), so a bugfix for your Laravel version requires waiting on Cartalyst's major-version cadence rather than being backward compatible within a range. The README has zero usage examples or code — everything defers to an external docs site (cartalyst.com/manual/sentinel), so there's no way to evaluate the actual API surface without leaving GitHub, and that external site becomes a single point of failure for anyone depending on the package long-term. Security issues are funneled to an email address rather than a public advisory process, so there's no visible track record of past vulnerabilities or how quickly they get patched.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →