Laravel for Beginners: Authentication and Authorization

January 9, 2024 · 7 min read

Laravel for Beginners: Authentication and Authorization - Breeze Jetstream Fortify

2026 UPDATE - LARAVEL 13

We’re excited to announce that we have updated all of our blog post examples to reflect the new Laravel 13 version! Our previous examples were based on Laravel 10, but with the release of Laravel 13, we wanted to ensure that our readers have access to the most up-to-date information and examples.

Easy Authentication in Laravel

Laravel, known for its elegant syntax and robust features, simplifies the authentication process with built-in creating options. From basic login systems to advanced features, let’s explore how Laravel caters to authentication needs with tools like Laravel Breeze, Jetstream, and Fortify. In addition to these three, we have also included our own starter kit that we use for most of our projects, called Reactor for Laravel.

Laravel Breeze

For those looking for a minimal yet robust starting point for authentication, Laravel Breeze offers a simple implementation using Blade templates and Tailwind CSS. It provides a lightweight option for developers who prefer to stick with traditional server-side rendered applications.

We prefer this option because it’s simpler and makes it easier to follow this Laravel learning series for beginners.

To install Breeze, use the following commands:

composer require laravel/breeze --dev
php artisan breeze:install
npm install
npm run dev

Breeze sets up the routes, views, and controllers needed for registration, login, password reset, and email verification. It’s a perfect choice for those new to Laravel or those who want a clean, simple authentication system that can be easily customized.

‘Breeze Stacks in Laravel 13’

‘When you run ‘‘php artisan breeze:install’‘ in Laravel 13, you are prompted to select a stack. Breeze ships four officially supported stacks:’

‘Blade’‘ (default) — classic server-side rendering with Tailwind CSS. Best for beginners and traditional MPA apps.’
‘React / Inertia’‘ — single-page experience using React and Inertia.js, no separate API needed.’
‘Vue / Inertia’‘ — same approach as React/Inertia but using Vue 3.’
‘Livewire’‘ — reactive components via PHP, no JavaScript build step required.’

‘You can also pass the stack directly to skip the prompt:’

# Blade (default)
php artisan breeze:install blade

# React + Inertia
php artisan breeze:install react

# Vue + Inertia
php artisan breeze:install vue

# Livewire
php artisan breeze:install livewire

Laravel Jetstream

Laravel Jetstream is a more advanced application framework designed to replace the legacy Laravel UI. It provides a robust starting point for building a Laravel application with user authentication, two-factor authentication, session management, API support via Laravel Sanctum, and optional team management.

Jetstream uses Livewire or Inertia.js under the hood, giving you the choice between server-side rendering or a modern JavaScript-driven approach.

To get started with Jetstream, run the following commands:

composer require laravel/jetstream
php artisan jetstream:install inertia
npm install npm run dev

Replace inertia with livewire if you prefer to use Livewire.

Laravel Fortify

For developers who need more control over the frontend of their application, Laravel Fortify offers a backend implementation of login, registration, email verification, two-factor authentication, session management, and password reset features.

Fortify is a headless authentication backend that works seamlessly with your custom or existing frontend. It handles the complex, security-related aspects of authentication, allowing you to focus on the user interface.

To use Fortify, you can install it via Composer:

composer require laravel/fortify
php artisan vendor:publish --provider="Laravel\Fortify\FortifyServiceProvider"

After publishing Fortify’s resources, you can configure the features you want in the config/fortify.php file.

Reactor for Laravel

Laravel Breeze serves as a starting point with its minimal boilerplate. However, Reactor takes your development environment to the next level. It’s our starter kit that you can easily install and use once you reach a more advanced level of programming.

composer require lucky-media/reactor
php artisan reactor:install
npm run dev

Reactor simplifies your workflow with pre-configured ESLint and Prettier settings for consistent code formatting, enforces code standards with Husky hooks, and incorporates a Laravel Pint-based GitHub Workflow. Moreover, it boasts a suite of pre-designed frontend components, drawing inspiration from shadcn/ui, that prioritize both composability and ease of customization.

Breeze vs Jetstream vs Fortify: Comparison

Choosing the right authentication package often comes down to how much complexity your project needs. Here is a quick comparison to help you decide:

Laravel Breeze — Complexity: Low. Features: Login, registration, password reset, email verification, profile page. Stacks: Blade, React, Vue, Livewire. Best for: beginners, small-to-medium apps, projects where you want full visibility into the auth code.
Laravel Jetstream — Complexity: High. Features: Everything in Breeze plus two-factor authentication, session management, API tokens via Sanctum, and optional team management. Stacks: Livewire or Inertia. Best for: SaaS apps, team-based products, projects that need 2FA and API access out of the box.
Laravel Fortify — Complexity: Medium. Features: Headless backend for login, registration, 2FA, password reset, email verification, and passkeys. No frontend included. Best for: apps with a custom frontend (React SPA, mobile app, etc.) that need a well-tested auth backend without opinion on the UI.

Passkey Authentication in Laravel 13

Laravel 13 makes passkeys a first-class authentication option. Passkeys are a modern, passwordless standard (WebAuthn) that lets users authenticate using Face ID, Touch ID, Windows Hello, or a hardware security key instead of a password.

Both Breeze and Fortify now include passkey support. When you install Breeze, you can enable passkeys by choosing the passkey option during the stack installation prompt:

php artisan breeze:install
# When prompted, select passkey support to enable WebAuthn login

For Fortify, passkey support is enabled in config/fortify.php by adding Features::passkeys() to the features array:

// config/fortify.php
'features' => [
    Features::registration(),
    Features::resetPasswords(),
    Features::emailVerification(),
    Features::updateProfileInformation(),
    Features::updatePasswords(),
    Features::twoFactorAuthentication(),
    Features::passkeys(), // Enable passkey (WebAuthn) authentication
],

Passkeys are phishing-resistant, cannot be reused across sites, and remove the need for users to remember passwords. They are increasingly expected in modern web applications.

Frequently Asked Questions

What is the difference between Laravel Breeze and Jetstream?

Laravel Breeze is a minimal authentication starter kit focused on simplicity — it gives you login, registration, password reset, and email verification with clean, readable code you can fully own. Laravel Jetstream builds on top of that with a full application scaffold that adds two-factor authentication, session management, API tokens via Sanctum, and optional team management. Choose Breeze when you want a lightweight starting point; choose Jetstream when your project needs those enterprise features out of the box.

When should I use Laravel Fortify instead of Breeze?

Use Fortify when you are building an app with a custom frontend (a React SPA, a mobile app, or a headless architecture) and you need a well-tested, configurable authentication backend without any frontend opinions. Fortify handles all the logic; you build the UI yourself. If you want pre-built views and a working UI out of the box, use Breeze instead.

Does Laravel 13 support passkeys?

Yes. Laravel 13 ships passkey (WebAuthn) support as a built-in option in both Breeze and Fortify. Passkeys let users log in using Face ID, fingerprint, or a hardware security key instead of a password. They are phishing-resistant and increasingly recommended as a replacement for traditional password-based login.

Can I add authentication to an existing Laravel app?

Yes. You can install Breeze or Fortify into an existing Laravel application at any time. Run composer require laravel/breeze --dev followed by php artisan breeze:install and Breeze will publish its routes, views, and controllers into your project. Review the published files before running migrations to make sure nothing conflicts with your existing user table structure.

The simplest path is Laravel Breeze with the Blade stack. Install it with composer require laravel/breeze --dev && php artisan breeze:install blade, run npm install && npm run dev, and then php artisan migrate. You will have a fully working login, registration, and password reset system with Tailwind-styled views in under five minutes.

Conclusion

Laravel provides a rich set of tools for implementing authentication, each tailored to different needs and preferences. Whether you’re looking for a simple, all-inclusive solution like Breeze, a more advanced setup with Jetstream, or a backend-focused approach with Fortify, Laravel has you covered.

For beginners, starting with Laravel Breeze is recommended as it offers an easy-to-understand and manageable authentication system. As you grow more comfortable with Laravel and its offerings, you can explore Jetstream and Fortify to find the perfect fit for your blog’s authentication requirements.